Selea Targa IP Camera 跨站请求伪造漏洞通过管理员创建

The impact of this CSRF vulnerability is significant. An attacker can leverage it to add new administrative accounts to the Selea Targa IP OCR-ANPR Camera system. Once an administrative account is created, the attacker gains full control, including the ability to modify camera settings, access video streams, and potentially compromise the entire network segment the camera is connected to. This could lead to unauthorized surveillance, data breaches, and disruption of security operations. The ease of exploitation, requiring only a crafted malicious web page and a logged-in user visiting it, amplifies the risk.

Organizations utilizing Selea Targa IP OCR-ANPR Cameras, version 1.0.0–Model: iZero, are at risk. This includes deployments in traffic monitoring systems, security surveillance networks, and access control applications. Shared hosting environments where multiple cameras might be managed from a single administrative interface are particularly vulnerable.

1. 2025-12-09Disclosure

   disclosure

1. 已保留2025-12-07
2. 发布日期2025-12-09
3. 修改日期2026-04-07
4. EPSS 更新日期2026-03-23

Due to the lack of a provided fixed version, immediate mitigation focuses on reducing the attack surface and preventing exploitation. Implement strict input validation on all administrative endpoints to prevent malicious data from being submitted. Crucially, implement robust CSRF protection mechanisms, such as synchronizer tokens or double-submit cookies, to prevent unauthorized requests. Consider temporarily disabling administrative interfaces if feasible. Regularly review user accounts and permissions to identify and remove any suspicious accounts. Monitor network traffic for unusual activity related to the camera’s administrative interface.