Loading story…
TP-Link patched a high-severity authentication bypass vulnerability in its VIGI surveillance camera product line that allows an attacker with local network (LAN) access to reset the administrator password and take full control of affected devices. Tracked as CVE-2026-0629 (CVSS v4.0 8.7), the issue is in the cameras’ local web interface password recovery workflow, where improper reliance on client-side state enables password reset without verification, requiring no privileges or user interaction.
Successful exploitation can enable attackers to access or manipulate live/recorded video, change configurations, disable security features, and potentially use compromised cameras as a pivot for lateral movement or botnet/DDoS activity. Reporting attributes the discovery to Arko Dhar (Redinent Innovations) and notes broad model impact across VIGI C and VIGI InSight lines (reported as 28 series in one account and 32+ models in another); one researcher assessment identified 2,500+ internet-exposed potentially vulnerable devices from checks of a single model, suggesting wider exposure where cameras are reachable from the internet despite the LAN-oriented attack vector.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On January 20, 2026, reports publicly described CVE-2026-0629 as a high-severity authentication bypass caused by client-side state manipulation that lets an attacker on the local network reset the admin password and gain full administrative control.
By January 2026, TP-Link had released firmware updates for more than 32 affected VIGI C and VIGI InSight camera models to fix CVE-2026-0629, an authentication bypass in the password recovery feature.
In October 2025, researcher Arko Dhar identified more than 2,500 internet-exposed TP-Link VIGI cameras vulnerable to CVE-2026-0629 by checking a single model, indicating broader exposure was likely.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Akamai’s Security Intelligence and Response Team (SIRT) disclosed a **critical remote command injection** vulnerability in *Vivotek* legacy IP camera firmware tracked as **CVE-2026-22755** (reported **CVSS 9.3**). The flaw enables **unauthenticated attackers to execute arbitrary commands as `root`** by abusing the camera’s file upload handling in the `upload_map.cgi` CGI endpoint, where a user-controlled filename is incorporated into a formatted string and then passed to a shell via `system()` without proper sanitization, allowing shell metacharacter injection (e.g., `;`). Technical reporting indicates exploitation hinges on crafting an upload that satisfies several implementation constraints (e.g., upload size limits and firmware validation behaviors) and invoking the upload path in a way that preserves required environment variables; researchers demonstrated command execution by embedding commands in the filename and observing `uid=0` output. The issue reportedly impacts **dozens of models (36 cited)** across multiple Vivotek product lines and is amplified by findings that some affected legacy devices may ship or operate **without passwords set by default**, increasing the likelihood of opportunistic compromise and downstream abuse (e.g., botnet recruitment and DDoS activity) in environments still running legacy surveillance infrastructure.
Jun 29, 2026
Cisco Talos disclosed newly patched vulnerabilities in **GeoVision** products as part of a broader third-party advisory covering WolfSSL, GeoVision, and VTK-DICOM. The GeoVision portion spans **14 advisories and 37 CVEs**, including weaknesses such as OS command injection, privilege escalation, reflected XSS, guessable session cookies, insufficient encryption, lack of authentication, and buffer-handling flaws. Talos said the affected vendors have released patches and noted that **Snort coverage** is available to help detect exploitation attempts. Reporting on the GeoVision issues highlighted critical flaws in **LPC2011/LPC2211** license-plate recognition cameras and **GV-VMS** software. In particular, `CVE-2026-42364` is an OS command injection in `DdnsSetting.cgi` on camera firmware `1.10`, and `CVE-2026-42368` is a privilege-escalation bug that can be chained for full **root compromise** through the web interface; a separate flaw, `CVE-2026-42369`, enables unauthenticated remote code execution in **GV-VMS V20**. Because the cameras are commonly deployed in parking, checkpoint, hospital, airport, and other physical-security environments, successful exploitation could provide a foothold for lateral movement, surveillance disruption, and access into adjacent building-management or access-control networks.
Jul 10, 2026
A critical vulnerability, tracked as CVE-2025-13607, has been identified in multiple CCTV camera products, including those from D-Link India Limited, Sparsh Securitech, and Securus CCTV. The flaw arises from missing authentication for a critical function, allowing remote attackers to access sensitive camera configuration data and administrative account credentials simply by exploiting a vulnerable URL endpoint. The vulnerability is network-accessible, requires no user interaction or special privileges, and has been assigned a CVSS v4 score of 9.3 and CVSS v3 score of 9.4, indicating its severe risk to surveillance infrastructure. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding this issue, and D-Link has released security updates for affected devices, urging immediate patching and verification of firmware versions. Successful exploitation of this vulnerability could enable attackers to hijack video feeds, steal credentials, and potentially compromise entire surveillance systems. The D-Link DCS-F5614-L1 camera model running firmware versions v1.03.038 and earlier is confirmed to be affected, while other models from Sparsh Securitech and Securus CCTV may also be vulnerable. Organizations using these products are strongly advised to apply available patches and review their camera deployments for exposure. The flaw's trivial exploitation path and the sensitive nature of the data at risk make prompt remediation critical for maintaining the integrity and confidentiality of video surveillance operations.
Jun 29, 2026