CVE-2026-0629: TP-Link VIGI Flaw Lets Attackers Reset Admin Passwords

CVE-2026-0629 has been disclosed as a high-severity vulnerability in TP-Link’s VIGI series surveillance cameras, allowing attackers on a local network to bypass authentication and reset the admin password via the password recovery feature. According to TP-Link, the flaw arises from how the device validates password reset requests, enabling an attacker on the LAN to reset the administrator password without verification by manipulating client-side state.

The advisory notes that once the password is reset, an attacker can log in with full administrative access, potentially disabling recording or altering network settings and pivoting to other devices on the network. The vulnerability affects models across the VIGI line, including the C340, C440, C540, and InSight series, with TP-Link having released firmware updates to address the issue across these product lines.

For example, the VIGI C340 2.0 model is fixed in firmware version 2.1.0 Build 250701 Rel.49304n or later, and users are urged to verify their model and firmware against the advisory and to update via the official TP-Link Download Center.