This vulnerability (CVE-2025-34022) is a CWE-22 path traversal issue in Selea Targa IP OCR-ANPR cameras, impacting multiple firmware versions and models. The flaw is in the /common/get_file.php script, which fails to properly sanitize the 'file' parameter on the 'Download Archive in Storage' page. An attacker can exploit this to read arbitrary files on the device remotely without authentication. Sensitive files, including those with cleartext credentials, may be exposed, potentially leading to authentication bypass and system information disclosure. The vulnerability was confirmed exploited in the wild as of early 2025. The CVSS 4.0 vector indicates network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated remote attackers to read arbitrary files on affected devices, including sensitive system files containing cleartext credentials. This can lead to authentication bypass and exposure of critical system information, severely compromising device security and potentially enabling further attacks or unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is available, users should monitor Selea's advisories for updates. Until a fix is released, restrict network access to the affected devices to trusted networks only and consider disabling the vulnerable functionality if possible to reduce exposure.