CVE-2026-0629: Authentication Bypass in Password Recovery Feature via Local Web App on Multiple VIGI Cameras

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-16 · updated 2026-06-17
Weakness: CWE-287

Description

Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models allows an attacker on the LAN to reset the admin password without verification by manipulating client-side state. Attackers can gain full administrative access to the device, compromising configuration and network security.

Affected products

TP-Link Systems Inc. VIGI C230I Mini: before 2.1.0_Build_250701_Rel.47570n — fixed in 2.1.0_Build_250701_Rel.47570n
TP-Link Systems Inc. VIGI C240 1.0: before 2.1.0_Build_250701_Rel.48425n — fixed in 2.1.0_Build_250701_Rel.48425n
TP-Link Systems Inc. VIGI C250: before 2.1.0_Build_250702_Rel.54301n — fixed in 2.1.0_Build_250702_Rel.54301n
TP-Link Systems Inc. VIGI C340-W 2.x Series (C340-W 2.0/C340-W 2.20): before 2.1.1_Build_250717_Rel.66528n — fixed in 2.1.1_Build_250717_Rel.66528n
TP-Link Systems Inc. VIGI C340 2.0: before 2.1.0_Build_250701_Rel.49304n — fixed in 2.1.0_Build_250701_Rel.49304n
TP-Link Systems Inc. VIGI C340S: before 3.1.0_Build_250625_Rel.65381n — fixed in 3.1.0_Build_250625_Rel.65381n
TP-Link Systems Inc. VIGI C440-W 2.0: before 2.1.1_Build_250717_Rel.66632n — fixed in 2.1.1_Build_250717_Rel.66632n
TP-Link Systems Inc. VIGI C440 2.0: before 2.1.0_Build_250701_Rel.49778n — fixed in 2.1.0_Build_250701_Rel.49778n
TP-Link Systems Inc. VIGI C540-4G: before 2.2.0_Build_250826_Rel.56808n — fixed in 2.2.0_Build_250826_Rel.56808n
TP-Link Systems Inc. VIGI C540-W 2.0: before 2.1.1_Build_250717_Rel.67730n — fixed in 2.1.1_Build_250717_Rel.67730n
TP-Link Systems Inc. VIGI C540 2.0: before 2.1.0_Build_250701_Rel.50397n — fixed in 2.1.0_Build_250701_Rel.50397n
TP-Link Systems Inc. VIGI C540S / EasyCam C540S: before 3.1.0_Build_250625_Rel.66601n — fixed in 3.1.0_Build_250625_Rel.66601n
TP-Link Systems Inc. VIGI C540V: before 2.1.0_Build_250702_Rel.54300n — fixed in 2.1.0_Build_250702_Rel.54300n
TP-Link Systems Inc. VIGI Cx20 Series (C320/C420): before 2.1.0_Build_250701_Rel.39597n — fixed in 2.1.0_Build_250701_Rel.39597n
TP-Link Systems Inc. VIGI Cx20I 1.0 Series (C220I 1.0/C320I 1.0/C420I 1.0): before 2.1.0_Build_251014_Rel.58331n — fixed in 2.1.0_Build_251014_Rel.58331n
TP-Link Systems Inc. VIGI Cx20I 1.20 Series (C220I 1.20/C320I 1.20/C420I 1.20): before 2.1.0_Build_250701_Rel.44071n — fixed in 2.1.0_Build_250701_Rel.44071n
TP-Link Systems Inc. VIGI Cx30 1.0 Series (C230 1.0/C330 1.0/C430 1.0): before 2.1.0_Build_250701_Rel.46796n — fixed in 2.1.0_Build_250701_Rel.46796n
TP-Link Systems Inc. VIGI Cx30 1.20 Series (C230 1.20/C330 1.20/C430 1.20): before 2.1.0_Build_250701_Rel.46796n — fixed in 2.1.0_Build_250701_Rel.46796n
TP-Link Systems Inc. VIGI Cx30I 1.0 Series (C230I 1.0/C330I 1.0/C430I 1.0): before 2.1.0_Build_250701_Rel.45506n — fixed in 2.1.0_Build_250701_Rel.45506n
TP-Link Systems Inc. VIGI Cx30I 1.20 Series (C230I 1.20/C330I 1.20/C430I 1.20): before 2.1.0_Build_250701_Rel.44555n — fixed in 2.1.0_Build_250701_Rel.44555n
TP-Link Systems Inc. VIGI Cx40I 1.0 Series (C240I 1.0/C340I 1.0/C440I 1.0): before 2.1.0_Build_250701_Rel.46003n — fixed in 2.1.0_Build_250701_Rel.46003n
TP-Link Systems Inc. VIGI Cx40I 1.20 Series (C240I 1.20/C340I 1.20/C440I 1.20): before 2.1.0_Build_250701_Rel.45041n — fixed in 2.1.0_Build_250701_Rel.45041n
TP-Link Systems Inc. VIGI Cx45 Series (C345/C445): before 3.1.0_Build_250820_Rel.57668n — fixed in 3.1.0_Build_250820_Rel.57668n
TP-Link Systems Inc. VIGI Cx50 Series (C350/C450): before 2.1.0_Build_250702_Rel.54294n — fixed in 2.1.0_Build_250702_Rel.54294n
TP-Link Systems Inc. VIGI Cx55 Series (C355/C455): before 3.1.0_Build_250820_Rel.58873n — fixed in 3.1.0_Build_250820_Rel.58873n
TP-Link Systems Inc. VIGI Cx85 Series (C385/C485): before 3.0.2_Build_250630_Rel.71279n — fixed in 3.0.2_Build_250630_Rel.71279n
TP-Link Systems Inc. VIGI InSight S345-4G: before 2.1.0_Build_250725_Rel.36867n — fixed in 2.1.0_Build_250725_Rel.36867n
TP-Link Systems Inc. VIGI InSight S655I: before 1.1.1_Build_250625_Rel.64224n — fixed in 1.1.1_Build_250625_Rel.64224n
TP-Link Systems Inc. VIGI InSight Sx25 Series (S225/S325/S425): before 1.1.0_Build_250630_Rel.39597n — fixed in 1.1.0_Build_250630_Rel.39597n
TP-Link Systems Inc. VIGI InSight Sx45 Series (S245/S345/S445): before 3.1.0_Build_250820_Rel.57668n — fixed in 3.1.0_Build_250820_Rel.57668n

How to fix

Upgrade to a fixed version: TP-Link Systems Inc. VIGI C230I Mini 2.1.0_Build_250701_Rel.47570n; TP-Link Systems Inc. VIGI C240 1.0 2.1.0_Build_250701_Rel.48425n; TP-Link Systems Inc. VIGI C250 2.1.0_Build_250702_Rel.54301n; TP-Link Systems Inc. VIGI C340-W 2.x Series (C340-W 2.0/C340-W 2.20) 2.1.1_Build_250717_Rel.66528n; TP-Link Systems Inc. VIGI C340 2.0 2.1.0_Build_250701_Rel.49304n; TP-Link Systems Inc. VIGI C340S 3.1.0_Build_250625_Rel.65381n; TP-Link Systems Inc. VIGI C440-W 2.0 2.1.1_Build_250717_Rel.66632n; TP-Link Systems Inc. VIGI C440 2.0 2.1.0_Build_250701_Rel.49778n; TP-Link Systems Inc. VIGI C540-4G 2.2.0_Build_250826_Rel.56808n; TP-Link Systems Inc. VIGI C540-W 2.0 2.1.1_Build_250717_Rel.67730n; TP-Link Systems Inc. VIGI C540 2.0 2.1.0_Build_250701_Rel.50397n; TP-Link Systems Inc. VIGI C540S / EasyCam C540S 3.1.0_Build_250625_Rel.66601n. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-0629 or the next vulnerability affects your stack