TP-Link has disclosed a high-severity authentication bypass vulnerability affecting its VIGI security camera lineup, allowing attackers on local networks to reset administrator passwords without verification.
The flaw lies in the password recovery feature of the local web interface, which is exploited via client-side state manipulation.
The vulnerability (CVE-2026-0629) enables threat actors positioned on the same local area network (LAN) to gain full administrative access to VIGI cameras by circumventing the password recovery authentication mechanism.
By manipulating client-side state variables during recovery, attackers bypass verification checks intended to prevent unauthorized password resets.
This attack vector is particularly concerning because it requires no prior authentication, no special privileges, and occurs entirely through local web interface interactions.
Once administrative credentials are compromised, attackers gain complete control over camera configuration, video streams, and network positioning, effectively turning the camera into a reconnaissance tool or network pivot point.
The vulnerability carries a CVSS v4.0 base score of 8.7, categorized as High severity due to significant impact on confidentiality, integrity, and availability.
The attack complexity is low, and no user interaction is required beyond the attacker’s presence on the network segment.
The vulnerability affects an extensive range of VIGI products across multiple series, including the VIGI Cx45, Cx55, and Cx85 bullet camera lines, the Cx30/Cx40/Cx50 indoor surveillance series, panoramic models such as the Cx20 and Cx20I, and the VIGI InSight commercial-grade surveillance system.
Affected product Table Data
| Product Series | Fixed Version | Impact Level | Status |
| VIGI Cx45 | ≥ 3.1.0 | Full Admin Access Compromise | Patched |
| VIGI Cx55 | ≥ 3.1.0 | Full Admin Access Compromise | Patched |
| VIGI Cx85 | ≥ 3.0.2 | Full Admin Access Compromise | Patched |
| VIGI C340S | ≥ 3.1.0 | Full Admin Access Compromise | Patched |
| VIGI C540S | ≥ 3.1.0 | Full Admin Access Compromise | Patched |
| VIGI C540V | ≥ 2.1.0 | Full Admin Access Compromise | Patched |
| VIGI C250 | ≥ 2.1.0 | Full Admin Access Compromise | Patched |
| VIGI Cx50 | ≥ 2.1.0 | Full Admin Access Compromise | Patched |
| VIGI Cx20I (1.0) | ≥ 2.1.0 | Full Admin Access Compromise | Patched |
| VIGI Cx20I (1.20) | ≥ 2.1.0 | Full Admin Access Compromise | Patched |
| VIGI Cx30I (1.0) | ≥ 2.1.0 | Full Admin Access Compromise | Patched |
| VIGI Cx30I (1.20) | ≥ 2.1.0 | Full Admin Access Compromise | Patched |
| VIGI Cx30 (1.0) |
TP-Link has confirmed that at least 30 distinct hardware variants require patching.
Notably affected models include the widely deployed C340S, C540S, C540V (turret design), C250, and specialized variants like the C540-4G with cellular connectivity.
The vulnerability also affects wireless models in the Cx40-W series and advanced InSight models with pan-tilt-zoom capabilities.
TP-Link released coordinated firmware patches across affected product lines beginning in late June 2025, with additional releases through August 2025. Update builds vary by hardware series but are available across regional download centers.
Users should immediately download and install the latest firmware from their respective regional support portals: United States users should access support.vigi.com/us, while Indian deployments should use the India-specific download center.
Each affected product series received specific patch versions addressing the authentication bypass for instance, VIGI Cx45 models require Build 250820 Rel.57668n or later. In contrast, Cx50 series devices require Build 250702 Rel. 54294n minimum.
This vulnerability poses a significant risk to organizations operating VIGI surveillance infrastructure, particularly enterprises with cameras on management networks.
The local-network requirement means vulnerabilities are primarily exploitable by internal threat actors, contractors, or adversaries who have breached perimeter security.
Organizations should prioritize firmware updates as critical infrastructure maintenance, verify network segmentation isolating cameras to dedicated VLAN segments, and review camera access logs for suspicious administrative activity though attackers may remove evidence post-exploitation.
Download patches from regional TP-Link support centers now, validate successful deployment across your camera fleet, and consider implementing additional network access controls restricting administrative interface access to authorized personnel and systems only.
Follow us on Google News, LinkedIn, and X to Get Instant Updates ancd Set GBH as a Preferred Source in Google.