Read the docs
TI-2026-00427 Aliases CVE-2026-0629GHSA-2262-37j2-53g4

Authentication Bypass in Password Recovery Feature via Local Web App on Multiple VIGI Cameras

Priority MEDIUM 40CWE-287Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models allows an attacker on the LAN to reset the admin password without verification by manipulating client-side state. Attackers can gain full administrative access to the device, compromising configuration and network security.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00419 36th percentileScored 2026-11-07
Fix Fixed VIGI InSight Sx45 Series (S245/S345/S445) (TP-Link Systems Inc.): 3.1.0_Build_250820_Rel.57668nVIGI Cx45 Series (C345/C445) (TP-Link Systems Inc.): 3.1.0_Build_250820_Rel.57668n+32 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkVIGI InSight Sx45 Series (S245/S345/S445)before 3.1.0_Build_250820_Rel.57668n3.1.0_Build_250820_Rel.57668nPatch availableCNA
TP-LinkVIGI Cx45 Series (C345/C445)before 3.1.0_Build_250820_Rel.57668n3.1.0_Build_250820_Rel.57668nPatch availableCNA
TP-LinkVIGI InSight Sx55 Series (S355/S455)before 3.1.0_Build_250820_Rel.58873n3.1.0_Build_250820_Rel.58873nPatch availableCNA
TP-LinkVIGI Cx55 Series (C355/C455)before 3.1.0_Build_250820_Rel.58873n3.1.0_Build_250820_Rel.58873nPatch availableCNA
TP-LinkVIGI InSight Sx85 Series (S285/S385)before 3.0.2_Build_250630_Rel.71279n3.0.2_Build_250630_Rel.71279nPatch availableCNA
TP-LinkVIGI Cx85 Series (C385/C485)before 3.0.2_Build_250630_Rel.71279n3.0.2_Build_250630_Rel.71279nPatch availableCNA
TP-LinkVIGI InSight S655Ibefore 1.1.1_Build_250625_Rel.64224n1.1.1_Build_250625_Rel.64224nPatch availableCNA
TP-LinkVIGI InSight Sx45ZI Series (S245ZI/S345ZI/S445ZI)before 1.2.0_Build_250820_Rel.60930n1.2.0_Build_250820_Rel.60930nPatch availableCNA
TP-LinkVIGI InSight Sx85PI Series (S385PI/S485PI)before 1.2.0_Build_250827_Rel.66817n1.2.0_Build_250827_Rel.66817nPatch availableCNA
TP-LinkVIGI C340Sbefore 3.1.0_Build_250625_Rel.65381n3.1.0_Build_250625_Rel.65381nPatch availableCNA
TP-LinkVIGI C540S / EasyCam C540Sbefore 3.1.0_Build_250625_Rel.66601n3.1.0_Build_250625_Rel.66601nPatch availableCNA
TP-LinkVIGI C540Vbefore 2.1.0_Build_250702_Rel.54300n2.1.0_Build_250702_Rel.54300nPatch availableCNA
TP-LinkVIGI C250before 2.1.0_Build_250702_Rel.54301n2.1.0_Build_250702_Rel.54301nPatch availableCNA
TP-LinkVIGI Cx50 Series (C350/C450)before 2.1.0_Build_250702_Rel.54294n2.1.0_Build_250702_Rel.54294nPatch availableCNA
TP-LinkVIGI Cx20I 1.0 Series (C220I 1.0/C320I 1.0/C420I 1.0)before 2.1.0_Build_251014_Rel.58331n2.1.0_Build_251014_Rel.58331nPatch availableCNA
TP-LinkVIGI Cx20I 1.20 Series (C220I 1.20/C320I 1.20/C420I 1.20)before 2.1.0_Build_250701_Rel.44071n2.1.0_Build_250701_Rel.44071nPatch availableCNA
TP-LinkVIGI Cx30I 1.0 Series (C230I 1.0/C330I 1.0/C430I 1.0)before 2.1.0_Build_250701_Rel.45506n2.1.0_Build_250701_Rel.45506nPatch availableCNA
TP-LinkVIGI Cx30I 1.20 Series (C230I 1.20/C330I 1.20/C430I 1.20)before 2.1.0_Build_250701_Rel.44555n2.1.0_Build_250701_Rel.44555nPatch availableCNA
TP-LinkVIGI Cx40I 1.0 Series (C240I 1.0/C340I 1.0/C440I 1.0)before 2.1.0_Build_250701_Rel.46003n2.1.0_Build_250701_Rel.46003nPatch availableCNA
TP-LinkVIGI Cx40I 1.20 Series (C240I 1.20/C340I 1.20/C440I 1.20)before 2.1.0_Build_250701_Rel.45041n2.1.0_Build_250701_Rel.45041nPatch availableCNA
TP-LinkVIGI Cx30 1.0 Series (C230 1.0/C330 1.0/C430 1.0)before 2.1.0_Build_250701_Rel.46796n2.1.0_Build_250701_Rel.46796nPatch availableCNA
TP-LinkVIGI Cx30 1.20 Series (C230 1.20/C330 1.20/C430 1.20)before 2.1.0_Build_250701_Rel.46796n2.1.0_Build_250701_Rel.46796nPatch availableCNA
TP-LinkVIGI C230I Minibefore 2.1.0_Build_250701_Rel.47570n2.1.0_Build_250701_Rel.47570nPatch availableCNA
TP-LinkVIGI C240 1.0before 2.1.0_Build_250701_Rel.48425n2.1.0_Build_250701_Rel.48425nPatch availableCNA
TP-LinkVIGI C340 2.0before 2.1.0_Build_250701_Rel.49304n2.1.0_Build_250701_Rel.49304nPatch availableCNA
TP-LinkVIGI C440 2.0before 2.1.0_Build_250701_Rel.49778n2.1.0_Build_250701_Rel.49778nPatch availableCNA
TP-LinkVIGI C540 2.0before 2.1.0_Build_250701_Rel.50397n2.1.0_Build_250701_Rel.50397nPatch availableCNA
TP-LinkVIGI C540-4Gbefore 2.2.0_Build_250826_Rel.56808n2.2.0_Build_250826_Rel.56808nPatch availableCNA
TP-LinkVIGI C340-W 2.x Series (C340-W 2.0/C340-W 2.20)before 2.1.1_Build_250717_Rel.66528n2.1.1_Build_250717_Rel.66528nPatch availableCNA
TP-LinkVIGI C440-W 2.0before 2.1.1_Build_250717_Rel.66632n2.1.1_Build_250717_Rel.66632nPatch availableCNA
TP-LinkVIGI C540-W 2.0before 2.1.1_Build_250717_Rel.67730n2.1.1_Build_250717_Rel.67730nPatch availableCNA
TP-LinkVIGI InSight S345-4Gbefore 2.1.0_Build_250725_Rel.36867n2.1.0_Build_250725_Rel.36867nPatch availableCNA
TP-LinkVIGI InSight Sx25 Series (S225/S325/S425)before 1.1.0_Build_250630_Rel.39597n1.1.0_Build_250630_Rel.39597nPatch availableCNA
TP-LinkVIGI Cx20 Series (C320/C420)before 2.1.0_Build_250701_Rel.39597n2.1.0_Build_250701_Rel.39597nPatch availableCNA
  • VIGI InSight Sx45 Series (S245/S345/S445) VendorTP-Link Affected before 3.1.0_Build_250820_Rel.57668n Fixed in 3.1.0_Build_250820_Rel.57668n Patch available CNA
  • VIGI Cx45 Series (C345/C445) VendorTP-Link Affected before 3.1.0_Build_250820_Rel.57668n Fixed in 3.1.0_Build_250820_Rel.57668n Patch available CNA
  • VIGI InSight Sx55 Series (S355/S455) VendorTP-Link Affected before 3.1.0_Build_250820_Rel.58873n Fixed in 3.1.0_Build_250820_Rel.58873n Patch available CNA
  • VIGI Cx55 Series (C355/C455) VendorTP-Link Affected before 3.1.0_Build_250820_Rel.58873n Fixed in 3.1.0_Build_250820_Rel.58873n Patch available CNA
  • VIGI InSight Sx85 Series (S285/S385) VendorTP-Link Affected before 3.0.2_Build_250630_Rel.71279n Fixed in 3.0.2_Build_250630_Rel.71279n Patch available CNA
  • VIGI Cx85 Series (C385/C485) VendorTP-Link Affected before 3.0.2_Build_250630_Rel.71279n Fixed in 3.0.2_Build_250630_Rel.71279n Patch available CNA
  • VIGI InSight S655I VendorTP-Link Affected before 1.1.1_Build_250625_Rel.64224n Fixed in 1.1.1_Build_250625_Rel.64224n Patch available CNA
  • VIGI InSight Sx45ZI Series (S245ZI/S345ZI/S445ZI) VendorTP-Link Affected before 1.2.0_Build_250820_Rel.60930n Fixed in 1.2.0_Build_250820_Rel.60930n Patch available CNA
  • VIGI InSight Sx85PI Series (S385PI/S485PI) VendorTP-Link Affected before 1.2.0_Build_250827_Rel.66817n Fixed in 1.2.0_Build_250827_Rel.66817n Patch available CNA
  • VIGI C340S VendorTP-Link Affected before 3.1.0_Build_250625_Rel.65381n Fixed in 3.1.0_Build_250625_Rel.65381n Patch available CNA
  • VIGI C540S / EasyCam C540S VendorTP-Link Affected before 3.1.0_Build_250625_Rel.66601n Fixed in 3.1.0_Build_250625_Rel.66601n Patch available CNA
  • VIGI C540V VendorTP-Link Affected before 2.1.0_Build_250702_Rel.54300n Fixed in 2.1.0_Build_250702_Rel.54300n Patch available CNA
  • VIGI C250 VendorTP-Link Affected before 2.1.0_Build_250702_Rel.54301n Fixed in 2.1.0_Build_250702_Rel.54301n Patch available CNA
  • VIGI Cx50 Series (C350/C450) VendorTP-Link Affected before 2.1.0_Build_250702_Rel.54294n Fixed in 2.1.0_Build_250702_Rel.54294n Patch available CNA
  • VIGI Cx20I 1.0 Series (C220I 1.0/C320I 1.0/C420I 1.0) VendorTP-Link Affected before 2.1.0_Build_251014_Rel.58331n Fixed in 2.1.0_Build_251014_Rel.58331n Patch available CNA
  • VIGI Cx20I 1.20 Series (C220I 1.20/C320I 1.20/C420I 1.20) VendorTP-Link Affected before 2.1.0_Build_250701_Rel.44071n Fixed in 2.1.0_Build_250701_Rel.44071n Patch available CNA
  • VIGI Cx30I 1.0 Series (C230I 1.0/C330I 1.0/C430I 1.0) VendorTP-Link Affected before 2.1.0_Build_250701_Rel.45506n Fixed in 2.1.0_Build_250701_Rel.45506n Patch available CNA
  • VIGI Cx30I 1.20 Series (C230I 1.20/C330I 1.20/C430I 1.20) VendorTP-Link Affected before 2.1.0_Build_250701_Rel.44555n Fixed in 2.1.0_Build_250701_Rel.44555n Patch available CNA
  • VIGI Cx40I 1.0 Series (C240I 1.0/C340I 1.0/C440I 1.0) VendorTP-Link Affected before 2.1.0_Build_250701_Rel.46003n Fixed in 2.1.0_Build_250701_Rel.46003n Patch available CNA
  • VIGI Cx40I 1.20 Series (C240I 1.20/C340I 1.20/C440I 1.20) VendorTP-Link Affected before 2.1.0_Build_250701_Rel.45041n Fixed in 2.1.0_Build_250701_Rel.45041n Patch available CNA
  • VIGI Cx30 1.0 Series (C230 1.0/C330 1.0/C430 1.0) VendorTP-Link Affected before 2.1.0_Build_250701_Rel.46796n Fixed in 2.1.0_Build_250701_Rel.46796n Patch available CNA
  • VIGI Cx30 1.20 Series (C230 1.20/C330 1.20/C430 1.20) VendorTP-Link Affected before 2.1.0_Build_250701_Rel.46796n Fixed in 2.1.0_Build_250701_Rel.46796n Patch available CNA
  • VIGI C230I Mini VendorTP-Link Affected before 2.1.0_Build_250701_Rel.47570n Fixed in 2.1.0_Build_250701_Rel.47570n Patch available CNA
  • VIGI C240 1.0 VendorTP-Link Affected before 2.1.0_Build_250701_Rel.48425n Fixed in 2.1.0_Build_250701_Rel.48425n Patch available CNA
  • VIGI C340 2.0 VendorTP-Link Affected before 2.1.0_Build_250701_Rel.49304n Fixed in 2.1.0_Build_250701_Rel.49304n Patch available CNA
  • VIGI C440 2.0 VendorTP-Link Affected before 2.1.0_Build_250701_Rel.49778n Fixed in 2.1.0_Build_250701_Rel.49778n Patch available CNA
  • VIGI C540 2.0 VendorTP-Link Affected before 2.1.0_Build_250701_Rel.50397n Fixed in 2.1.0_Build_250701_Rel.50397n Patch available CNA
  • VIGI C540-4G VendorTP-Link Affected before 2.2.0_Build_250826_Rel.56808n Fixed in 2.2.0_Build_250826_Rel.56808n Patch available CNA
  • VIGI C340-W 2.x Series (C340-W 2.0/C340-W 2.20) VendorTP-Link Affected before 2.1.1_Build_250717_Rel.66528n Fixed in 2.1.1_Build_250717_Rel.66528n Patch available CNA
  • VIGI C440-W 2.0 VendorTP-Link Affected before 2.1.1_Build_250717_Rel.66632n Fixed in 2.1.1_Build_250717_Rel.66632n Patch available CNA
  • VIGI C540-W 2.0 VendorTP-Link Affected before 2.1.1_Build_250717_Rel.67730n Fixed in 2.1.1_Build_250717_Rel.67730n Patch available CNA
  • VIGI InSight S345-4G VendorTP-Link Affected before 2.1.0_Build_250725_Rel.36867n Fixed in 2.1.0_Build_250725_Rel.36867n Patch available CNA
  • VIGI InSight Sx25 Series (S225/S325/S425) VendorTP-Link Affected before 1.1.0_Build_250630_Rel.39597n Fixed in 1.1.0_Build_250630_Rel.39597n Patch available CNA
  • VIGI Cx20 Series (C320/C420) VendorTP-Link Affected before 2.1.0_Build_250701_Rel.39597n Fixed in 2.1.0_Build_250701_Rel.39597n Patch available CNA

Remediation

  • Fix · CNA VIGI InSight Sx45 Series (S245/S345/S445) (TP-Link Systems Inc.) Fixed in 3.1.0_Build_250820_Rel.57668n
  • Fix · CNA VIGI Cx45 Series (C345/C445) (TP-Link Systems Inc.) Fixed in 3.1.0_Build_250820_Rel.57668n
  • Fix · CNA VIGI InSight Sx55 Series (S355/S455) (TP-Link Systems Inc.) Fixed in 3.1.0_Build_250820_Rel.58873n
  • Fix · CNA VIGI Cx55 Series (C355/C455) (TP-Link Systems Inc.) Fixed in 3.1.0_Build_250820_Rel.58873n
  • Fix · CNA VIGI InSight Sx85 Series (S285/S385) (TP-Link Systems Inc.) Fixed in 3.0.2_Build_250630_Rel.71279n
  • Fix · CNA VIGI Cx85 Series (C385/C485) (TP-Link Systems Inc.) Fixed in 3.0.2_Build_250630_Rel.71279n
  • Fix · CNA VIGI InSight S655I (TP-Link Systems Inc.) Fixed in 1.1.1_Build_250625_Rel.64224n
  • Fix · CNA VIGI InSight Sx45ZI Series (S245ZI/S345ZI/S445ZI) (TP-Link Systems Inc.) Fixed in 1.2.0_Build_250820_Rel.60930n
  • Fix · CNA VIGI InSight Sx85PI Series (S385PI/S485PI) (TP-Link Systems Inc.) Fixed in 1.2.0_Build_250827_Rel.66817n
  • Fix · CNA VIGI C340S (TP-Link Systems Inc.) Fixed in 3.1.0_Build_250625_Rel.65381n
  • Fix · CNA VIGI C540S / EasyCam C540S (TP-Link Systems Inc.) Fixed in 3.1.0_Build_250625_Rel.66601n
  • Fix · CNA VIGI C540V (TP-Link Systems Inc.) Fixed in 2.1.0_Build_250702_Rel.54300n
  • Fix · CNA VIGI C250 (TP-Link Systems Inc.) Fixed in 2.1.0_Build_250702_Rel.54301n
  • Fix · CNA VIGI Cx50 Series (C350/C450) (TP-Link Systems Inc.) Fixed in 2.1.0_Build_250702_Rel.54294n
  • Fix · CNA VIGI Cx20I 1.0 Series (C220I 1.0/C320I 1.0/C420I 1.0) (TP-Link Systems Inc.) Fixed in 2.1.0_Build_251014_Rel.58331n
  • Fix · CNA VIGI Cx20I 1.20 Series (C220I 1.20/C320I 1.20/C420I 1.20) (TP-Link Systems Inc.) Fixed in 2.1.0_Build_250701_Rel.44071n
  • Fix · CNA VIGI Cx30I 1.0 Series (C230I 1.0/C330I 1.0/C430I 1.0) (TP-Link Systems Inc.) Fixed in 2.1.0_Build_250701_Rel.45506n
  • Fix · CNA VIGI Cx30I 1.20 Series (C230I 1.20/C330I 1.20/C430I 1.20) (TP-Link Systems Inc.) Fixed in 2.1.0_Build_250701_Rel.44555n
  • Fix · CNA VIGI Cx40I 1.0 Series (C240I 1.0/C340I 1.0/C440I 1.0) (TP-Link Systems Inc.) Fixed in 2.1.0_Build_250701_Rel.46003n
  • Fix · CNA VIGI Cx40I 1.20 Series (C240I 1.20/C340I 1.20/C440I 1.20) (TP-Link Systems Inc.) Fixed in 2.1.0_Build_250701_Rel.45041n
  • Fix · CNA VIGI Cx30 1.0 Series (C230 1.0/C330 1.0/C430 1.0) (TP-Link Systems Inc.) Fixed in 2.1.0_Build_250701_Rel.46796n
  • Fix · CNA VIGI Cx30 1.20 Series (C230 1.20/C330 1.20/C430 1.20) (TP-Link Systems Inc.) Fixed in 2.1.0_Build_250701_Rel.46796n
  • Fix · CNA VIGI C230I Mini (TP-Link Systems Inc.) Fixed in 2.1.0_Build_250701_Rel.47570n
  • Fix · CNA VIGI C240 1.0 (TP-Link Systems Inc.) Fixed in 2.1.0_Build_250701_Rel.48425n
  • Fix · CNA VIGI C340 2.0 (TP-Link Systems Inc.) Fixed in 2.1.0_Build_250701_Rel.49304n
  • Fix · CNA VIGI C440 2.0 (TP-Link Systems Inc.) Fixed in 2.1.0_Build_250701_Rel.49778n
  • Fix · CNA VIGI C540 2.0 (TP-Link Systems Inc.) Fixed in 2.1.0_Build_250701_Rel.50397n
  • Fix · CNA VIGI C540-4G (TP-Link Systems Inc.) Fixed in 2.2.0_Build_250826_Rel.56808n
  • Fix · CNA VIGI C340-W 2.x Series (C340-W 2.0/C340-W 2.20) (TP-Link Systems Inc.) Fixed in 2.1.1_Build_250717_Rel.66528n
  • Fix · CNA VIGI C440-W 2.0 (TP-Link Systems Inc.) Fixed in 2.1.1_Build_250717_Rel.66632n
  • Fix · CNA VIGI C540-W 2.0 (TP-Link Systems Inc.) Fixed in 2.1.1_Build_250717_Rel.67730n
  • Fix · CNA VIGI InSight S345-4G (TP-Link Systems Inc.) Fixed in 2.1.0_Build_250725_Rel.36867n
  • Fix · CNA VIGI InSight Sx25 Series (S225/S325/S425) (TP-Link Systems Inc.) Fixed in 1.1.0_Build_250630_Rel.39597n
  • Fix · CNA VIGI Cx20 Series (C320/C420) (TP-Link Systems Inc.) Fixed in 2.1.0_Build_250701_Rel.39597n

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-0629
  2. 2026-10-03 Alias added: GHSA-2262-37j2-53g4

References

Patch 3

Advisory 1

  • TI-2023-16571 TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain… KEVCVSS 3.1HIGH 8.8
  • TI-2023-01313 Command injection in TP-Link Archer AX21 KEVCVSS 3.1HIGH 8.8
  • TI-2020-14907 TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the… KEVCVSS 3.1HIGH 8.8
  • TI-2025-08589 Authenticated RCE via Parental Control command injection KEVCVSS 4.0HIGH 8.6
  • TI-2015-02672 Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317… KEVCVSS 3.1HIGH 7.5
  • TI-2023-27456 Authentication bypass by spoofing in TP-Link TL-WR841N KEVCVSS 3.1MEDIUM 6.5
See all 636 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences