Skip to content
Fencer Vulns
high 8.7

CVE-2026-0629 json

Authentication Bypass in Password Recovery Feature via Local Web App on Multiple VIGI Cameras

published 2026-01-16 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-2932

cvss
8.7
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits
0
none known

Summary

Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models allows an attacker on the LAN to reset the admin password without verification by manipulating client-side state. Attackers can gain full administrative access to the device, compromising configuration and network security.

Patch / fix

  • TP-Link Systems Inc. VIGI InSight Sx45 Series (S245/S345/S445) 3.1.0_Build_250820_Rel.57668n
  • TP-Link Systems Inc. VIGI Cx45 Series (C345/C445) 3.1.0_Build_250820_Rel.57668n
  • TP-Link Systems Inc. VIGI InSight Sx55 Series (S355/S455) 3.1.0_Build_250820_Rel.58873n
  • TP-Link Systems Inc. VIGI Cx55 Series (C355/C455) 3.1.0_Build_250820_Rel.58873n
  • TP-Link Systems Inc. VIGI InSight Sx85 Series (S285/S385) 3.0.2_Build_250630_Rel.71279n
  • TP-Link Systems Inc. VIGI Cx85 Series (C385/C485) 3.0.2_Build_250630_Rel.71279n
  • TP-Link Systems Inc. VIGI InSight S655I 1.1.1_Build_250625_Rel.64224n
  • TP-Link Systems Inc. VIGI InSight Sx45ZI Series (S245ZI/S345ZI/S445ZI) 1.2.0_Build_250820_Rel.60930n
  • TP-Link Systems Inc. VIGI InSight Sx85PI Series (S385PI/S485PI) 1.2.0_Build_250827_Rel.66817n
  • TP-Link Systems Inc. VIGI C340S 3.1.0_Build_250625_Rel.65381n
  • TP-Link Systems Inc. VIGI C540S / EasyCam C540S 3.1.0_Build_250625_Rel.66601n
  • TP-Link Systems Inc. VIGI C540V 2.1.0_Build_250702_Rel.54300n
  • TP-Link Systems Inc. VIGI C250 2.1.0_Build_250702_Rel.54301n
  • TP-Link Systems Inc. VIGI Cx50 Series (C350/C450) 2.1.0_Build_250702_Rel.54294n
  • TP-Link Systems Inc. VIGI Cx20I 1.0 Series (C220I 1.0/C320I 1.0/C420I 1.0) 2.1.0_Build_251014_Rel.58331n
  • TP-Link Systems Inc. VIGI Cx20I 1.20 Series (C220I 1.20/C320I 1.20/C420I 1.20) 2.1.0_Build_250701_Rel.44071n
  • TP-Link Systems Inc. VIGI Cx30I 1.0 Series (C230I 1.0/C330I 1.0/C430I 1.0) 2.1.0_Build_250701_Rel.45506n
  • TP-Link Systems Inc. VIGI Cx30I 1.20 Series (C230I 1.20/C330I 1.20/C430I 1.20) 2.1.0_Build_250701_Rel.44555n
  • TP-Link Systems Inc. VIGI Cx40I 1.0 Series (C240I 1.0/C340I 1.0/C440I 1.0) 2.1.0_Build_250701_Rel.46003n
  • TP-Link Systems Inc. VIGI Cx40I 1.20 Series (C240I 1.20/C340I 1.20/C440I 1.20) 2.1.0_Build_250701_Rel.45041n
  • TP-Link Systems Inc. VIGI Cx30 1.0 Series (C230 1.0/C330 1.0/C430 1.0) 2.1.0_Build_250701_Rel.46796n
  • TP-Link Systems Inc. VIGI Cx30 1.20 Series (C230 1.20/C330 1.20/C430 1.20) 2.1.0_Build_250701_Rel.46796n
  • TP-Link Systems Inc. VIGI C230I Mini 2.1.0_Build_250701_Rel.47570n
  • TP-Link Systems Inc. VIGI C240 1.0 2.1.0_Build_250701_Rel.48425n
  • TP-Link Systems Inc. VIGI C340 2.0 2.1.0_Build_250701_Rel.49304n
  • TP-Link Systems Inc. VIGI C440 2.0 2.1.0_Build_250701_Rel.49778n
  • TP-Link Systems Inc. VIGI C540 2.0 2.1.0_Build_250701_Rel.50397n
  • TP-Link Systems Inc. VIGI C540-4G 2.2.0_Build_250826_Rel.56808n
  • TP-Link Systems Inc. VIGI C340-W 2.x Series (C340-W 2.0/C340-W 2.20) 2.1.1_Build_250717_Rel.66528n
  • TP-Link Systems Inc. VIGI C440-W 2.0 2.1.1_Build_250717_Rel.66632n

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-26-036-01 updated cvss 8.8

TP-Link Systems Inc. VIGI Series IP Camera

  • TP-Link Systems Inc. VIGI C230I Mini Series <=2.1.0_Build_250701_Rel.47570n TP-Link Systems Inc. VIGI C240 1.0 Series <=2.1.0_Build_250701_Rel.48425n TP-Link Systems Inc. VIGI C250 Series <=2.1.0_Build_250702_Rel.54301n TP-Link Systems Inc. VIGI C340 2.0 Series <=2.1.0_Build_250701_Rel.49304n TP-Link Systems Inc. VIGI C340S Series <=3.1.0_Build_250625_Rel.65381n TP-Link Systems Inc. VIGI C440 2.0 Series <=2.1.0_Build_250701_Rel.49778n
    +26 more products
    TP-Link Systems Inc. VIGI C540 2.0 Series <=2.1.0_Build_250701_Rel.50397n TP-Link Systems Inc. VIGI C540‑4G Series <=2.2.0_Build_250826_Rel.56808n TP-Link Systems Inc. VIGI C540S Series Models C540S, EasyCam C540S <=3.1.0_Build_250625_Rel.66601n TP-Link Systems Inc. VIGI C540V Series <=2.1.0_Build_250702_Rel.54300n TP-Link Systems Inc. VIGI Cx20 Series Models C320, C420 <=2.1.0_Build_250701_Rel.39597n TP-Link Systems Inc. VIGI Cx20I (1.0) Series Models C220I 1.0, C320I 1.0, C420I 1.0 <=2.1.0_Build_251014_Rel.58331n TP-Link Systems Inc. VIGI Cx20I (1.20) Series Models C220I 1.20, C320I 1.20, C420I 1.20 <=2.1.0_Build_250701_Rel.44071n TP-Link Systems Inc. VIGI Cx30 (1.0) Series Models C230 1.0, C330 1.0, C430 1.0 <=2.1.0_Build_250701_Rel.46796n TP-Link Systems Inc. VIGI Cx30 (1.20) Series Models C230 1.20, C330 1.20, C430 1.20 <=2.1.0_Build_250701_Rel.46796n TP-Link Systems Inc. VIGI Cx30I (1.0) Series Models C230I 1.0, C330I 1.0, C430I 1.0 <=2.1.0_Build_250701_Rel.45506n TP-Link Systems Inc. VIGI Cx30I (1.20) Series Models C230I 1.20, C330I 1.20, C430I 1.20 <=2.1.0_Build_250701_Rel.44555n TP-Link Systems Inc. VIGI Cx40‑W Series Models C340‑W 2.0/2.20, C440‑W 2.0, C540‑W 2.0 <=2.1.1_Build_250717 TP-Link Systems Inc. VIGI Cx40I (1.0) Series Models C240I 1.0, C340I 1.0, C440I 1.0 <=2.1.0_Build_250701_Rel.46003n TP-Link Systems Inc. VIGI Cx40I (1.20) Series Models C240I 1.20, C340I 1.20, C440I 1.20 <=2.1.0_Build_250701_Rel.45041n TP-Link Systems Inc. VIGI Cx45 Series Models C345, C445 <=3.1.0_Build_250820_Rel.57668n TP-Link Systems Inc. VIGI Cx50 Series Models C350, C450 <=2.1.0_Build_250702_Rel.54294n TP-Link Systems Inc. VIGI Cx55 Series Models C355, C455 <=3.1.0_Build_250820_Rel.58873n TP-Link Systems Inc. VIGI Cx85 Series Models C385, C485 <=3.0.2_Build_250630_Rel.71279n TP-Link Systems Inc. VIGI InSight S345‑4G Series <=2.1.0_Build_250725_Rel.36867n TP-Link Systems Inc. VIGI InSight S655I Series <=1.1.1_Build_250625_Rel.64224n TP-Link Systems Inc. VIGI InSight Sx25 Series Models S225, S325, S425 <=1.1.0_Build_250630_Rel.39597n TP-Link Systems Inc. VIGI InSight Sx45 Series Models S245, S345, S445 <=3.1.0_Build_250820_Rel.57668n TP-Link Systems Inc. VIGI InSight Sx45ZI Series Models S245ZI, S345ZI, S445ZI <=1.2.0_Build_250820_Rel.60930n TP-Link Systems Inc. VIGI InSight Sx55 Series Models S355, S455 <=3.1.0_Build_250820_Rel.58873n TP-Link Systems Inc. VIGI InSight Sx85 Series Models S285, S385 <=3.0.2_Build_250630_Rel.71279n TP-Link Systems Inc. VIGI InSight Sx85PI Series Models S385PI, S485PI <=1.2.0_Build_250827_Rel.66817n
    affected: mitigation “TP-Link Systems Inc. strongly recommends that users with affected devices take the following actions:” vigi.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
9 mo ago

Exploit prediction

0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.7 CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • TP-Link Systems Inc. VIGI InSight Sx45 Series (S245/S345/S445)
  • TP-Link Systems Inc. VIGI Cx45 Series (C345/C445)
  • TP-Link Systems Inc. VIGI InSight Sx55 Series (S355/S455)
  • TP-Link Systems Inc. VIGI Cx55 Series (C355/C455)
  • TP-Link Systems Inc. VIGI InSight Sx85 Series (S285/S385)
  • TP-Link Systems Inc. VIGI Cx85 Series (C385/C485)
  • TP-Link Systems Inc. VIGI InSight S655I
  • TP-Link Systems Inc. VIGI InSight Sx45ZI Series (S245ZI/S345ZI/S445ZI)
  • TP-Link Systems Inc. VIGI InSight Sx85PI Series (S385PI/S485PI)
  • TP-Link Systems Inc. VIGI C340S
  • TP-Link Systems Inc. VIGI C540S / EasyCam C540S
  • TP-Link Systems Inc. VIGI C540V
  • TP-Link Systems Inc. VIGI C250
  • TP-Link Systems Inc. VIGI Cx50 Series (C350/C450)
  • TP-Link Systems Inc. VIGI Cx20I 1.0 Series (C220I 1.0/C320I 1.0/C420I 1.0)
  • TP-Link Systems Inc. VIGI Cx20I 1.20 Series (C220I 1.20/C320I 1.20/C420I 1.20)
  • TP-Link Systems Inc. VIGI Cx30I 1.0 Series (C230I 1.0/C330I 1.0/C430I 1.0)
  • TP-Link Systems Inc. VIGI Cx30I 1.20 Series (C230I 1.20/C330I 1.20/C430I 1.20)
  • TP-Link Systems Inc. VIGI Cx40I 1.0 Series (C240I 1.0/C340I 1.0/C440I 1.0)
  • TP-Link Systems Inc. VIGI Cx40I 1.20 Series (C240I 1.20/C340I 1.20/C440I 1.20)
  • TP-Link Systems Inc. VIGI Cx30 1.0 Series (C230 1.0/C330 1.0/C430 1.0)
  • TP-Link Systems Inc. VIGI Cx30 1.20 Series (C230 1.20/C330 1.20/C430 1.20)
  • TP-Link Systems Inc. VIGI C230I Mini
  • TP-Link Systems Inc. VIGI C240 1.0
  • TP-Link Systems Inc. VIGI C340 2.0
  • TP-Link Systems Inc. VIGI C440 2.0
  • TP-Link Systems Inc. VIGI C540 2.0
  • TP-Link Systems Inc. VIGI C540-4G
  • TP-Link Systems Inc. VIGI C340-W 2.x Series (C340-W 2.0/C340-W 2.20)
  • TP-Link Systems Inc. VIGI C440-W 2.0
  • TP-Link Systems Inc. VIGI C540-W 2.0
  • TP-Link Systems Inc. VIGI InSight S345-4G
  • TP-Link Systems Inc. VIGI InSight Sx25 Series (S225/S325/S425)
  • TP-Link Systems Inc. VIGI Cx20 Series (C320/C420)

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.