TP-Link Vulnerability Allows Authentication Bypass via Password Recovery Feature

TP-Link has released a critical security advisory addressing an authentication bypass vulnerability in its VIGI camera series that could allow attackers on local area networks (LANs) to reset administrative passwords without verification.

Tracked as CVE-2026-0629, this vulnerability poses significant risks to organizations and individuals relying on these surveillance systems for security monitoring.

The authentication bypass exists in the password recovery feature of the local web interface across multiple VIGI camera models.

The vulnerability stems from improper validation of client-side state during the password recovery process, enabling attackers on the same network to manipulate the recovery mechanism and gain unauthorized administrative access.

An attacker exploiting this flaw requires only local network access; no authentication credentials or complex attack vectors are necessary.

Once an attacker gains administrative access, they can modify camera configurations, disable logging, alter network settings, or completely compromise the surveillance infrastructure.

This level of access fundamentally undermines the security posture of affected deployments and creates pathways for lateral movement within enterprise networks.

The vulnerability carries a CVSS v4.0 score of 8.7, classified as high severity. The attack vector is network-adjacent (AV:A), requires low complexity (AC:L), and exploits an unauthenticated endpoint (PR:N).

Most critically, successful exploitation grants the attacker high-impact access across confidentiality, integrity, and availability dimensions (VC:H/VI:H/VA:H). Organizations operating these cameras should treat this as a priority remediation target.

Mitigations

TP-Link’s advisory identifies 28 distinct camera models across multiple product lines, including the popular VIGI Cx series (C345, C445, C355, C455) and VIGI InSight Sx series.

The vulnerability affects firmware versions released across 2024 and early 2025, though patch availability varies by model and region.

Organizations should immediately verify their deployed firmware versions against the provided fix matrices and prioritize updates for cameras exposed to untrusted networks.

Affected Series	Models	Fixed in Version	Priority
VIGI Cx45	C345, C445	≥3.1.0 Build 250820	Critical
VIGI Cx55	C355, C455	≥3.1.0 Build 250820	Critical
VIGI Cx85	C385, C485	≥3.0.2 Build 250630	Critical
VIGI C540S	C540S, EasyCam C540S	≥3.1.0 Build 250625	Critical
VIGI InSight Sx45	S245, S345, S445	≥3.1.0 Build 250820	Critical
VIGI InSight Sx55	S355, S455	≥3.1.0 Build 250820	Critical

TP-Link strongly recommends organizations immediately download and deploy the latest firmware versions to affected devices.

Updates are available through regional download centers: the US support portal maintains versions for North American deployments, while the international and India-specific portals provide localized distributions.

IT teams should establish a testing and deployment schedule to minimize operational disruption while maintaining security compliance.

Networks should be segmented to restrict camera access to necessary administrative personnel and monitoring systems, reducing the attack surface during remediation.

Organizations without immediate patching capabilities should implement network-level controls restricting local network access to cameras and disable password recovery features where operationally feasible.

Monitoring systems should log all administrative access attempts and configuration changes for forensic analysis.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.