Server-Side Request Forgery Vulnerability in Selea Targa IP Cameras
CVE-2025-34021

7.8HIGH

Key Information:

Vendor

Selea

Status
Targa Ip Ocr-anpr Camera
Vendor
CVE Published:
20 June 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-34021?

A server-side request forgery vulnerability has been identified in various Selea Targa IP OCR-ANPR camera models. This vulnerability arises from insufficient validation of user-supplied input in JSON POST parameters, such as ipnotify_address and url. As a result, attackers may exploit this flaw to send arbitrary HTTP requests, enabling access to both internal and external systems. The potential consequences include circumvention of firewall policies and the ability to conduct unauthorized internal service enumeration, exposing sensitive information and further system vulnerabilities.

Affected Version(s)

Targa IP OCR-ANPR Camera BLD201113005214

Targa IP OCR-ANPR Camera BLD201106163745

Targa IP OCR-ANPR Camera BLD200304170901

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-34021 - Proof of Concept

CVE-2025-34021 - Proof of Concept

CVE-2025-34021 - Proof of Concept

References

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-56...
third-party-advisoryexploit
https://www.exploit-db.com/exploits/49457
third-party-advisoryexploit
https://cxsecurity.com/issue/WLB-2021010170
third-party-advisoryexploit

CVSS V4

Score:
7.8
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gjoko Krstic
.
CVE-2025-34021 : Server-Side Request Forgery Vulnerability in Selea Targa IP Cameras