CVE-2026-0629 Authentication Bypass in TP-Link VIGI Cameras via Password Recovery

TP-Link patched a high-severity authentication bypass vulnerability in its VIGI surveillance camera product line that allows an attacker with local network (LAN) access to reset the administrator password and take full control of affected devices. Tracked as CVE-2026-0629 (CVSS v4.0 8.7), the issue is in the cameras’ local web interface password recovery workflow, where improper reliance on client-side state enables password reset without verification, requiring no privileges or user interaction.

Successful exploitation can enable attackers to access or manipulate live/recorded video, change configurations, disable security features, and potentially use compromised cameras as a pivot for lateral movement or botnet/DDoS activity. Reporting attributes the discovery to Arko Dhar (Redinent Innovations) and notes broad model impact across VIGI C and VIGI InSight lines (reported as 28 series in one account and 32+ models in another); one researcher assessment identified 2,500+ internet-exposed potentially vulnerable devices from checks of a single model, suggesting wider exposure where cameras are reachable from the internet despite the LAN-oriented attack vector.