CVE-2025-34021

Estado: AplazadaAlta (7.8)—

A server-side request forgery (SSRF) vulnerability exists in multiple Selea Targa IP OCR-ANPR camera models, including iZero, Targa 512, Targa 504, Targa Semplice, Targa 704 TKM, Targa 805, Targa 710 INOX, Targa 750, and Targa 704 ILB. The application fails to validate user-supplied input in JSON POST parameters such as ipnotify_address and url, which are used by internal mechanisms to perform image fetch and DNS lookups. This allows remote unauthenticated attackers to induce the system to make arbitrary HTTP requests to internal or external systems, potentially bypassing firewall policies or conducting internal service enumeration. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-25 UTC.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 7.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.60%
Percentil entre todas las CVEs puntuadas: 47
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access90 %
Impacto principalT1090 Proxycommand and control85 %
Impacto secundarioT1526 Cloud Service Discoverydiscovery75 %

SSRF en parámetros JSON sin validación de entrada (CWE-918) accesible remotamente sin autenticación (AV:N/PR:N/UI:N). Permite proxificar peticiones HTTP y enumeración de servicios internos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network Traffic Vulnerability Scanning SSL/TLS Inspection Privileged Account Management Network Segmentation Network Intrusion Prevention

Tecnologías afectadas (9)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Selea — Izero^AI Selea — Targa 504^AI Selea — Targa 512^AI Selea — Targa 704 ILB^AI Selea — Targa 704 TKM^AI Selea — Targa 710 Inox^AI Selea — Targa 750^AI Selea — Targa 805^AI Selea — Targa Semplice^AI

CWE

CWE-20, CWE-918

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-34021",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-34021",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-23T20:35:13.561170Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7.8,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "disclosure@vulncheck.com",
      "affectedData": [
        {
          "vendor": "Selea",
          "modules": [
            "Web Management Interface (IP notification and image retrieval handlers)"
          ],
          "product": "Targa IP OCR-ANPR Camera",
          "versions": [
            {
              "status": "affected",
              "version": "BLD201113005214",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "BLD201106163745",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "BLD200304170901",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "BLD200304170514",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "BLD200303143345",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "BLD191118145435",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "BLD191021180140",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "CPS 4.013(201105)",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "CPS 3.100(200225)",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "CPS 3.005(191206)",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "CPS 3.005(191112)",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-06-20T19:15:36.530",
  "references": [
    {
      "url": "https://cxsecurity.com/issue/WLB-2021010170",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://packetstorm.news/files/id/161059",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://vulncheck.com/advisories/selea-targa-ip-camera-ssrf",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/49457",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.selea.com",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5617.php",
      "source": "disclosure@vulncheck.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosure@vulncheck.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A server-side request forgery (SSRF) vulnerability exists in multiple Selea Targa IP OCR-ANPR camera models, including iZero, Targa 512, Targa 504, Targa Semplice, Targa 704 TKM, Targa 805, Targa 710 INOX, Targa 750, and Targa 704 ILB. The application fails to validate user-supplied input in JSON POST parameters such as ipnotify_address and url, which are used by internal mechanisms to perform image fetch and DNS lookups. This allows remote unauthenticated attackers to induce the system to make arbitrary HTTP requests to internal or external systems, potentially bypassing firewall policies or conducting internal service enumeration. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-25 UTC."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de server-side request forgery (SSRF) en varios modelos de Selea Targa IP OCR-ANPR camera, como iZero, Targa 512, Targa 504, Targa Semplice, Targa 704 TKM, Targa 805, Targa 710 INOX, Targa 750 y Targa 704 ILB. La aplicación no valida la entrada del usuario en parámetros JSON POST, como ipnotify_address y url, que utilizan los mecanismos internos para obtener imágenes y realizar búsquedas DNS. Esto permite a atacantes remotos no autenticados inducir al sistema a realizar solicitudes HTTP arbitrarias a sistemas internos o externos, lo que podría eludir las políticas del firewall o realizar la enumeración interna de servicios."
    }
  ],
  "lastModified": "2026-06-17T09:13:19.250",
  "sourceIdentifier": "disclosure@vulncheck.com"
}