CVE-2025-34022 is a critical security vulnerability classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal) affecting multiple models of Selea Targa IP OCR-ANPR cameras, including iZero, Targa 512, Targa 504, Targa Semplice, Targa 704 TKM, Targa 805, Targa 710 INOX, Targa 750, and Targa 704 ILB. The flaw resides in the /common/get_file.php script used in the 'Download Archive in Storage' functionality, where the file parameter is not properly sanitized or validated. This allows unauthenticated remote attackers to craft requests that traverse directories and access arbitrary files on the device's filesystem. Critical system files, including those containing cleartext credentials, can be read, which may lead to authentication bypass and disclosure of sensitive system information. The vulnerability is exploitable over the network without any authentication or user interaction, making it highly accessible to attackers. The CVSS 4.0 base score is 9.3, reflecting the critical nature of the flaw with high impact on confidentiality and system integrity, and a wide scope of affected devices due to multiple vulnerable firmware versions. Evidence of exploitation was observed by the Shadowserver Foundation on February 2, 2025, indicating active interest or attacks in the wild. No official patches have been linked yet, increasing urgency for mitigation. The affected firmware versions span multiple releases from late 2019 through 2020 and 2021, suggesting a long window of exposure. Given the role of these cameras in automatic number plate recognition (ANPR) systems, the vulnerability poses a significant risk to surveillance and traffic monitoring infrastructures.

For European organizations, especially those in law enforcement, transportation, and critical infrastructure sectors relying on Selea Targa IP OCR-ANPR cameras, this vulnerability presents a severe risk. Exploitation can lead to unauthorized disclosure of sensitive data, including credentials that could allow attackers to gain persistent access or control over the camera devices. This compromises the integrity and availability of surveillance data, potentially disrupting traffic monitoring and law enforcement operations. The exposure of system information may facilitate further attacks on the network or connected systems. Given the criticality of ANPR systems in public safety and urban management, exploitation could undermine trust and operational effectiveness. Additionally, attackers could leverage compromised devices as pivot points for lateral movement within organizational networks. The unauthenticated nature of the exploit increases the likelihood of attacks from external threat actors, including cybercriminals or state-sponsored groups targeting European infrastructure. The potential for widespread impact is heightened by the multiple affected firmware versions and the absence of available patches at the time of disclosure.

Immediate mitigation should focus on network-level protections such as isolating the affected cameras from untrusted networks and restricting access to the /common/get_file.php endpoint via firewall rules or web application firewalls (WAFs). Organizations should conduct an inventory of all Selea Targa IP OCR-ANPR camera models and firmware versions in use to identify vulnerable devices. Until official patches are released, disabling or limiting the 'Download Archive in Storage' functionality may reduce exposure. Monitoring network traffic for suspicious requests targeting the vulnerable script can help detect exploitation attempts. Implementing strong network segmentation to separate camera devices from critical IT infrastructure will limit potential lateral movement. Organizations should also enforce strict credential management and consider rotating any exposed credentials immediately. Once Selea releases firmware updates addressing CVE-2025-34022, prompt application of these patches is essential. Additionally, security teams should review and enhance logging and alerting mechanisms on camera management interfaces to detect anomalous access patterns. Collaboration with vendors and sharing threat intelligence within industry groups can improve situational awareness and response.