A critical authentication vulnerability affecting TP-Link’s VIGI surveillance camera lineup has been disclosed, enabling attackers on local networks to reset administrative credentials without authorization.
Tracked as CVE-2026-0629, the flaw resides in the camera’s web interface password recovery function and carries a CVSS v4.0 score of 8.7, indicating high severity.
The authentication bypass flaw stems from improper client-side state manipulation in the password recovery feature.
Attackers on the local area network (LAN) can exploit this weakness to reset the admin password without any verification, granting full administrative access to the affected device.
| CVE ID | Vendor | Product | Vulnerability Type | CVSS v4.0 | Attack Vector |
|---|---|---|---|---|---|
| CVE-2026-0629 | TP-Link | VIGI Cameras (Multiple Series) | Authentication Bypass via Password Recovery | 8.7 | Adjacent Network (LAN) |
The vulnerability requires no elevated privileges, user interaction, or network-level attacks, making it easily exploitable for any user with LAN connectivity.
According to the advisory documentation, the CVSS v4.0 scoring vector (4.0/AV: A/AC: L/AT: N/PR: N/UI: N/VC:H/VI:H/VA:H/SC: N/SI: N/SA: N).
Attackers can achieve high-impact compromises of confidentiality, integrity, and availability through adjacent network access with low attack complexity.
Successful exploitation allows attackers to gain complete control of affected VIGI cameras, enabling configuration modifications and disabling security features.
Accessing recorded footage or using compromised devices as pivot points for lateral network movement. Organizations with VIGI cameras in critical surveillance infrastructure face substantial operational and security risks.
The vulnerability affects an extensive product portfolio spanning 28 distinct VIGI camera series, including the popular Cx45, Cx55, Cx85, and InSight series variants.
The widespread impact necessitates immediate patching across all organizational deployments.
Affected Products and Mitigations
| Product Series | Models | Fixed Version |
|---|---|---|
| VIGI Cx45 | C345, C445 | ≥ 3.1.0 Build 250820 Rel.57668n |
| VIGI Cx55 | C355, C455 | ≥ 3.1.0 Build 250820 Rel.58873n |
| VIGI Cx85 | C385, C485 | ≥ 3.0.2 Build 250630 Rel.71279n |
| VIGI C340S | C340S | ≥ 3.1.0 Build 250625 Rel.65381n |
| VIGI C540S | C540S, EasyCam C540S | ≥ 3.1.0 Build 250625 Rel.66601n |
| VIGI InSight Sx45 | S245, S345, S445 | ≥ 3.1.0 Build 250820 Rel.57668n |
| VIGI InSight Sx55 | S355, S455 | ≥ 3.1.0 Build 250820 Rel.58873n |
Complete patch information for all affected product variants is available through TP-Link’s official support channels.
TP-Link has released firmware updates addressing the vulnerability across all affected device models. Organizations must download and deploy the latest firmware versions immediately through the Download Center.
The advisory emphasizes that devices remain vulnerable until patched, and TP-Link assumes no liability for incidents resulting from failure to implement recommended security updates.
Users can access patches through region-specific download centers:
| Region | Download Portal |
|---|---|
| United States | vigi.com/us/support/download/ |
| Global (English) | vigi.com/en/support/download/ |
| India | vigi.com/in/support/download/ |
CVE-2026-0629 represents a significant security risk for organizations deploying TP-Link VIGI surveillance infrastructure. The ease of exploitation, combined with the extensive affected product range, makes immediate firmware updates.
A critical priority for maintaining network security posture and preventing unauthorized administrative access to surveillance systems.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
