CVE-2026-0629 | THREATINT

Description

Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models allows an attacker on the LAN to reset the admin password without verification by manipulating client-side state. Attackers can gain full administrative access to the device, compromising configuration and network security.

PUBLISHED Reserved 2026-01-06 | Published 2026-01-16 | Updated 2026-01-16 | Assigner TPLink

HIGH: 8.7CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-287 Improper Authentication

Product status

Default status

unaffected

Any version before 3.1.0_Build_250820_Rel.57668n

affected

Default status

unaffected

Any version before 3.1.0_Build_250820_Rel.57668n

affected

Default status

unaffected

Any version before 3.1.0_Build_250820_Rel.58873n

affected

Default status

unaffected

Any version before 3.1.0_Build_250820_Rel.58873n

affected

Default status

unaffected

Any version before 3.0.2_Build_250630_Rel.71279n

affected

Default status

unaffected

Any version before 3.0.2_Build_250630_Rel.71279n

affected

Default status

unaffected

Any version before 1.1.1_Build_250625_Rel.64224n

affected

Default status

unaffected

Any version before 1.2.0_Build_250820_Rel.60930n

affected

Default status

unaffected

Any version before 1.2.0_Build_250827_Rel.66817n

affected

Default status

unaffected

Any version before 3.1.0_Build_250625_Rel.65381n

affected

Default status

unaffected

Any version before 3.1.0_Build_250625_Rel.66601n

affected

Default status

unaffected

Any version before 2.1.0_Build_250702_Rel.54300n

affected

Default status

unaffected

Any version before 2.1.0_Build_250702_Rel.54301n

affected

Default status

unaffected

Any version before 2.1.0_Build_250702_Rel.54294n

affected

Default status

unaffected

Any version before 2.1.0_Build_251014_Rel.58331n

affected

Default status

unaffected

Any version before 2.1.0_Build_250701_Rel.44071n

affected

Default status

unaffected

Any version before 2.1.0_Build_250701_Rel.45506n

affected

Default status

unaffected

Any version before 2.1.0_Build_250701_Rel.44555n

affected

Default status

unaffected

Any version before 2.1.0_Build_250701_Rel.46003n

affected

Default status

unaffected

Any version before 2.1.0_Build_250701_Rel.45041n

affected

Default status

unaffected

Any version before 2.1.0_Build_250701_Rel.46796n

affected

Default status

unaffected

Any version before 2.1.0_Build_250701_Rel.46796n

affected

Default status

unaffected

Any version before 2.1.0_Build_250701_Rel.47570n

affected

Default status

unaffected

Any version before 2.1.0_Build_250701_Rel.48425n

affected

Default status

unaffected

Any version before 2.1.0_Build_250701_Rel.49304n

affected

Default status

unaffected

Any version before 2.1.0_Build_250701_Rel.49778n

affected

Default status

unaffected

Any version before 2.1.0_Build_250701_Rel.50397n

affected

Default status

unaffected

Any version before 2.2.0_Build_250826_Rel.56808n

affected

Default status

unaffected

Any version before 2.1.1_Build_250717_Rel.66528n

affected

Default status

unaffected

Any version before 2.1.1_Build_250717_Rel.66632n

affected

Default status

unaffected

Any version before 2.1.1_Build_250717_Rel.67730n

affected

Default status

unaffected

Any version before 2.1.0_Build_250725_Rel.36867n

affected

Default status

unaffected

Any version before 1.1.0_Build_250630_Rel.39597n

affected

Default status

unaffected

Any version before 2.1.0_Build_250701_Rel.39597n

affected

References

www.vigi.com/us/support/download/ patch

www.vigi.com/en/support/download/ patch

www.vigi.com/in/support/download/ patch

www.tp-link.com/us/support/faq/4899/ vendor-advisory

cve.org (CVE-2026-0629)

nvd.nist.gov (CVE-2026-0629)

Download JSON