TP-Link Patches Vulnerability Exposing VIGI Cameras to Remote Hacking

TP-Link has patched a serious vulnerability that can be exploited to take control of more than 32 of its VIGI C and VIGI InSight series professional surveillance camera models, in what TP-Link describes as an authentication bypass affecting the cameras’ local web interface. The flaw, tracked as CVE-2026-0629 and classified as high severity, allows an attacker on the LAN to reset the admin password without verification by manipulating client-side state, enabling full admin access to the device, according to TP-Link.

The vulnerability was discovered by Arko Dhar, co-founder and CTO of IoT cybersecurity company Redinent Innovations, who told SecurityWeek that an attacker could gain complete access to the targeted camera, including its video feed and other functionality. Dhar warned the flaw can be exploited remotely and identified more than 2,500 internet‑exposed cameras worldwide as potentially vulnerable at the time of discovery in October 2025, with the total number of exposed devices possibly higher.

TP-Link’s VIGI cameras are used in over 36 countries, and while threat actors to target TP-Link products is a claim noted in the article, organisations are urged not to ignore the flaw. According to the TP-Link advisory, the patch mitigates the issue now.