Critical TP-Link VIGI camera flaw allowed remote takeover of surveillance systems

TP-Link fixed a high-severity vulnerability, tracked as CVE-2026-0629, that affected over 32 VIGI C and VIGI InSight camera models and exposed more than 2,500 internet-exposed devices as of October 2025. The flaw allows attackers on a local network to bypass authentication by abusing the password recovery feature, reset the admin password, and take full control of the cameras, potentially exposing live and recorded video and enabling spying or other malicious activity.

According to TP-Link, the authentication bypass in the password recovery feature of the local web interface in VIGI cameras lets an attacker on the LAN reset the admin password without verification by manipulating client-side state. Researcher Arko Dhar from Redinent Innovations reported the vulnerability and indicated the flaw could be exploited remotely, with the caveat that he only checked one model.

The advisory notes that attackers could move inside corporate networks, build botnets for DDoS attacks, tamper with evidence, and disrupt operations, highlighting privacy and regulatory risks. The article, published on 20 January 2026, refers to a high-severity vulnerability with a CVSS score of 8.7.