EUVD-2025-18779Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
Lifecycle Timeline
4DescriptionCVE.org
A server-side request forgery (SSRF) vulnerability exists in multiple Selea Targa IP OCR-ANPR camera models, including iZero, Targa 512, Targa 504, Targa Semplice, Targa 704 TKM, Targa 805, Targa 710 INOX, Targa 750, and Targa 704 ILB. The application fails to validate user-supplied input in JSON POST parameters such as ipnotify_address and url, which are used by internal mechanisms to perform image fetch and DNS lookups. This allows remote unauthenticated attackers to induce the system to make arbitrary HTTP requests to internal or external systems, potentially bypassing firewall policies or conducting internal service enumeration. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-25 UTC.
AnalysisAI
CVE-2025-34021 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting multiple Selea Targa IP OCR-ANPR camera models that allows remote unauthenticated attackers to induce arbitrary HTTP requests through unvalidated JSON POST parameters (ipnotify_address and url). An attacker can bypass firewall policies, enumerate internal services, or redirect image fetch and DNS lookup operations to internal or external systems of their choosing. Active exploitation was confirmed by the Shadowserver Foundation on 2025-01-25, indicating real-world attack activity and operational risk.
Technical ContextAI
The vulnerability resides in the JSON POST request parsing mechanism of Selea Targa IP OCR-ANPR camera models. The root cause is CWE-20 (Improper Input Validation), where the application accepts user-supplied input in parameters such as 'ipnotify_address' and 'url' without proper sanitization or validation before using these values in internal HTTP requests and DNS lookups. This is a classic SSRF vulnerability pattern: attacker-controlled URLs are passed directly to internal image fetching and DNS resolution routines without verification that the destination is legitimate or intended. The affected product line includes multiple Selea camera models (iZero, Targa 512, 504, Semplice, 704 TKM, 805, 710 INOX, 750, 704 ILB) running vulnerable firmware versions. These cameras are typically deployed in traffic monitoring and license plate recognition (ANPR) infrastructure, often with network-level trust assumptions that this vulnerability violates.
RemediationAI
Immediate actions: (1) Contact Selea directly for patched firmware versions addressing input validation of ipnotify_address and url JSON parameters; (2) Implement network segmentation to restrict camera access to essential services only, reducing SSRF impact scope; (3) Disable or restrict the image fetch and DNS notification features if operationally feasible until patches are applied; (4) Monitor JSON POST traffic to cameras for suspicious ipnotify_address or url parameter values pointing to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or localhost; (5) Apply host-based or network-level firewall rules to prevent cameras from initiating outbound connections to internal infrastructure; (6) Update camera firmware to the latest patched version once Selea releases advisories (check Selea security advisories portal); (7) Implement Web Application Firewall (WAF) rules on any proxy/gateway controlling camera access to reject POST requests with suspicious parameter patterns. Vendor advisory is referenced as confirmed exploitation evidence from Shadowserver (2025-01-25), suggesting Selea has or will issue formal advisory.
Share
External POC / Exploit Code
Leaving vuln.today