A critical vulnerability in Selea CarPlateServer allows unauthenticated attackers to achieve remote code execution and full administrative control over the affected system.

The application suffers from a remote program execution flaw triggered by manipulating the NO_LIST_EXE_PATH configuration parameter. An unauthenticated attacker can access the /cps/ endpoint to bypass authentication, modify server settings, and execute arbitrary Windows binaries with system privileges.

Successful exploitation grants an attacker complete control over the CarPlateServer, which is often used for critical infrastructure traffic monitoring and law enforcement operations. This risk includes unauthorized access to sensitive surveillance data, the potential for permanent system compromise, and the ability to pivot into internal networks from the affected server. The high CVSS score of 7.5 reflects the severe impact of unauthenticated remote code execution on operational availability and data integrity.

Immediate Action: Restrict network access to the CarPlateServer /cps/ endpoint using a firewall or VPN to ensure it is not reachable from untrusted networks. If no official vendor patch is available, discontinue use of the affected software or isolate the host entirely from the production network.

Proactive Monitoring: Monitor server logs for suspicious POST requests to the /config_request endpoint, especially those containing modifications to configuration parameters like NO_LIST_EXE_PATH. Review system logs for the execution of unexpected binaries spawned by the CPS service.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or inspect traffic directed at the /cps/ and /config_request endpoints. Ensure that the service account running the CarPlateServer application operates with the least privilege necessary to limit the impact of binary execution.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Zero Science Lab advisory and ExploitDB entry 49452.

The presence of a public exploit targeting an unauthenticated remote code execution flaw in a critical safety system presents an extreme risk. Organizations currently utilizing Selea CarPlateServer must prioritize isolating these systems from the internet immediately. In the absence of a vendor-provided patch, users should assume the software is insecure and move toward decommissioning or complete network segregation to prevent potential exploitation.