TP-Link Patches Authentication Bypass Flaw in VIGI Cameras
Take action: Make sure all CCTV devices are isolated from the internet and accessible from trusted networks only. Segment your surveillance cameras into a dedicated VLAN and if possible disable the password recovery feature on the local web interface. Then plan a patch cycle.
Learn More
TP-Link released a security advisory for a flaw in its VIGI camera series that lets attackers on a local network bypass authentication. It targets the password recovery tool in the camera's local web interface.
The flaw is tracked as CVE-2026-0629 (CVSS score 8.7) and is caused by a improper validation of client-side state during the password recovery process. Attackers only need access to the same local area network (LAN) as the camera to fool the password recovery mechanism.
Successful exploitation gives an attacker full administrative control. They can change camera settings, stop logs, or alter network configurations.
Affected devices include:
- VIGI Cx series (C345, C445, C355, C455, C385, C485)
- VIGI InSight Sx series (S245, S345, S445, S285, S385)
- VIGI C340S, C540S, C540V, and C250 models
- VIGI Cx20I, Cx30I, and Cx40I series
TP-Link urges users to install the latest firmware immediately. Updates are available on the official TP-Link support portal. If you cannot patch right away, isolate the cameras to a private network segment and restrict access to trusted staff only.
