PT-2026-3270 · Unknown · Vigi Camera

Arko Dhar

+1

·

Published

2026-01-16

·

Updated

2026-02-27

·

CVE-2026-0629

CVSS v4.0
8.7
VectorAV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions TP-Link VIGI Cameras (affected versions not specified)
Description An authentication bypass issue exists in the password recovery feature of the local web interface of TP-Link VIGI cameras. This allows an attacker on the Local Area Network (LAN) to reset the administrator password without verification by manipulating client-side state. Successful exploitation grants the attacker full administrative access to the device, potentially compromising configuration and network security. Over 2,500 internet-exposed cameras have been identified, increasing the risk of real-world takeover for poorly segmented or publicly reachable deployments. Attackers could gain access to live and recorded video feeds, disable security features, alter configurations, and potentially use the compromised devices for lateral movement within a network. The vulnerability affects over 32 VIGI C and InSight camera models.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-0629

Affected Products

Vigi Camera