Log in Start free

Vulnerability · Published Jan 16, 2026 · Assigned by TPLink

CVE-2026-0629Authentication Bypass in Password Recovery Feature via Local Web App on Multiple VIGI Cameras

High 8.7

In plain English

A high-severity improper authentication in VIGI C230I Mini from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.4%top 63.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models allows an attacker on the LAN to reset the admin password without verification by manipulating client-side state. Attackers can gain full administrative access to the device, compromising configuration and network security.

Affected products (as reported)

VendorProductVersions
TP-Link Systems Inc. VIGI InSight Sx45 Series (S245/S345/S445) 0 – before 3.1.0_Build_250820_Rel.57668n
TP-Link Systems Inc. VIGI Cx45 Series (C345/C445) 0 – before 3.1.0_Build_250820_Rel.57668n
TP-Link Systems Inc. VIGI InSight Sx55 Series (S355/S455) 0 – before 3.1.0_Build_250820_Rel.58873n
TP-Link Systems Inc. VIGI Cx55 Series (C355/C455) 0 – before 3.1.0_Build_250820_Rel.58873n
TP-Link Systems Inc. VIGI InSight Sx85 Series (S285/S385) 0 – before 3.0.2_Build_250630_Rel.71279n
TP-Link Systems Inc. VIGI Cx85 Series (C385/C485) 0 – before 3.0.2_Build_250630_Rel.71279n
TP-Link Systems Inc. VIGI InSight S655I 0 – before 1.1.1_Build_250625_Rel.64224n
TP-Link Systems Inc. VIGI InSight Sx45ZI Series (S245ZI/S345ZI/S445ZI) 0 – before 1.2.0_Build_250820_Rel.60930n
TP-Link Systems Inc. VIGI InSight Sx85PI Series (S385PI/S485PI) 0 – before 1.2.0_Build_250827_Rel.66817n
TP-Link Systems Inc. VIGI C340S 0 – before 3.1.0_Build_250625_Rel.65381n
TP-Link Systems Inc. VIGI C540S / EasyCam C540S 0 – before 3.1.0_Build_250625_Rel.66601n
TP-Link Systems Inc. VIGI C540V 0 – before 2.1.0_Build_250702_Rel.54300n
TP-Link Systems Inc. VIGI C250 0 – before 2.1.0_Build_250702_Rel.54301n
TP-Link Systems Inc. VIGI Cx50 Series (C350/C450) 0 – before 2.1.0_Build_250702_Rel.54294n
TP-Link Systems Inc. VIGI Cx20I 1.0 Series (C220I 1.0/C320I 1.0/C420I 1.0) 0 – before 2.1.0_Build_251014_Rel.58331n
TP-Link Systems Inc. VIGI Cx20I 1.20 Series (C220I 1.20/C320I 1.20/C420I 1.20) 0 – before 2.1.0_Build_250701_Rel.44071n
TP-Link Systems Inc. VIGI Cx30I 1.0 Series (C230I 1.0/C330I 1.0/C430I 1.0) 0 – before 2.1.0_Build_250701_Rel.45506n
TP-Link Systems Inc. VIGI Cx30I 1.20 Series (C230I 1.20/C330I 1.20/C430I 1.20) 0 – before 2.1.0_Build_250701_Rel.44555n
TP-Link Systems Inc. VIGI Cx40I 1.0 Series (C240I 1.0/C340I 1.0/C440I 1.0) 0 – before 2.1.0_Build_250701_Rel.46003n
TP-Link Systems Inc. VIGI Cx40I 1.20 Series (C240I 1.20/C340I 1.20/C440I 1.20) 0 – before 2.1.0_Build_250701_Rel.45041n
TP-Link Systems Inc. VIGI Cx30 1.0 Series (C230 1.0/C330 1.0/C430 1.0) 0 – before 2.1.0_Build_250701_Rel.46796n
TP-Link Systems Inc. VIGI Cx30 1.20 Series (C230 1.20/C330 1.20/C430 1.20) 0 – before 2.1.0_Build_250701_Rel.46796n
TP-Link Systems Inc. VIGI C230I Mini 0 – before 2.1.0_Build_250701_Rel.47570n
TP-Link Systems Inc. VIGI C240 1.0 0 – before 2.1.0_Build_250701_Rel.48425n
TP-Link Systems Inc. VIGI C340 2.0 0 – before 2.1.0_Build_250701_Rel.49304n
TP-Link Systems Inc. VIGI C440 2.0 0 – before 2.1.0_Build_250701_Rel.49778n
TP-Link Systems Inc. VIGI C540 2.0 0 – before 2.1.0_Build_250701_Rel.50397n
TP-Link Systems Inc. VIGI C540-4G 0 – before 2.2.0_Build_250826_Rel.56808n
TP-Link Systems Inc. VIGI C340-W 2.x Series (C340-W 2.0/C340-W 2.20) 0 – before 2.1.1_Build_250717_Rel.66528n
TP-Link Systems Inc. VIGI C440-W 2.0 0 – before 2.1.1_Build_250717_Rel.66632n

Weakness: CWE-287 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References