ICSA-26-036-01: TP-Link Systems Inc. VIGI Series IP Camera
CISA advisory · released 2026-02-05
Source record Collected from CISA's CSAF advisory feed
- Distribution label in the document: TLP:WHITE
- Revision 2, 2026-02-11 (final)
CISA's summary
Risk evaluation: Successful exploitation of this vulnerability could result in unauthorized users gaining administrative access to affected closed circuit television cameras.
Products, as the advisory lists them
| Vendor | Product | Version |
|---|---|---|
| TP-Link Systems Inc. | VIGI Cx45 Series Models C345, C445 | <=3.1.0_Build_250820_Rel.57668n |
| TP-Link Systems Inc. | VIGI Cx55 Series Models C355, C455 | <=3.1.0_Build_250820_Rel.58873n |
| TP-Link Systems Inc. | VIGI Cx85 Series Models C385, C485 | <=3.0.2_Build_250630_Rel.71279n |
| TP-Link Systems Inc. | VIGI C340S Series | <=3.1.0_Build_250625_Rel.65381n |
| TP-Link Systems Inc. | VIGI C540S Series Models C540S, EasyCam C540S | <=3.1.0_Build_250625_Rel.66601n |
| TP-Link Systems Inc. | VIGI C540V Series | <=2.1.0_Build_250702_Rel.54300n |
| TP-Link Systems Inc. | VIGI C250 Series | <=2.1.0_Build_250702_Rel.54301n |
| TP-Link Systems Inc. | VIGI Cx50 Series Models C350, C450 | <=2.1.0_Build_250702_Rel.54294n |
| TP-Link Systems Inc. | VIGI Cx20I (1.0) Series Models C220I 1.0, C320I 1.0, C420I 1.0 | <=2.1.0_Build_251014_Rel.58331n |
| TP-Link Systems Inc. | VIGI Cx20I (1.20) Series Models C220I 1.20, C320I 1.20, C420I 1.20 | <=2.1.0_Build_250701_Rel.44071n |
| TP-Link Systems Inc. | VIGI Cx30I (1.0) Series Models C230I 1.0, C330I 1.0, C430I 1.0 | <=2.1.0_Build_250701_Rel.45506n |
| TP-Link Systems Inc. | VIGI Cx30I (1.20) Series Models C230I 1.20, C330I 1.20, C430I 1.20 | <=2.1.0_Build_250701_Rel.44555n |
| TP-Link Systems Inc. | VIGI Cx30 (1.0) Series Models C230 1.0, C330 1.0, C430 1.0 | <=2.1.0_Build_250701_Rel.46796n |
| TP-Link Systems Inc. | VIGI Cx30 (1.20) Series Models C230 1.20, C330 1.20, C430 1.20 | <=2.1.0_Build_250701_Rel.46796n |
| TP-Link Systems Inc. | VIGI Cx40I (1.0) Series Models C240I 1.0, C340I 1.0, C440I 1.0 | <=2.1.0_Build_250701_Rel.46003n |
| TP-Link Systems Inc. | VIGI Cx40I (1.20) Series Models C240I 1.20, C340I 1.20, C440I 1.20 | <=2.1.0_Build_250701_Rel.45041n |
| TP-Link Systems Inc. | VIGI C230I Mini Series | <=2.1.0_Build_250701_Rel.47570n |
| TP-Link Systems Inc. | VIGI C240 1.0 Series | <=2.1.0_Build_250701_Rel.48425n |
| TP-Link Systems Inc. | VIGI C340 2.0 Series | <=2.1.0_Build_250701_Rel.49304n |
| TP-Link Systems Inc. | VIGI C440 2.0 Series | <=2.1.0_Build_250701_Rel.49778n |
| TP-Link Systems Inc. | VIGI C540 2.0 Series | <=2.1.0_Build_250701_Rel.50397n |
| TP-Link Systems Inc. | VIGI C540‑4G Series | <=2.2.0_Build_250826_Rel.56808n |
| TP-Link Systems Inc. | VIGI Cx40‑W Series Models C340‑W 2.0/2.20, C440‑W 2.0, C540‑W 2.0 | <=2.1.1_Build_250717 |
| TP-Link Systems Inc. | VIGI Cx20 Series Models C320, C420 | <=2.1.0_Build_250701_Rel.39597n |
| TP-Link Systems Inc. | VIGI InSight Sx45 Series Models S245, S345, S445 | <=3.1.0_Build_250820_Rel.57668n |
| TP-Link Systems Inc. | VIGI InSight Sx55 Series Models S355, S455 | <=3.1.0_Build_250820_Rel.58873n |
| TP-Link Systems Inc. | VIGI InSight Sx85 Series Models S285, S385 | <=3.0.2_Build_250630_Rel.71279n |
| TP-Link Systems Inc. | VIGI InSight Sx45ZI Series Models S245ZI, S345ZI, S445ZI | <=1.2.0_Build_250820_Rel.60930n |
| TP-Link Systems Inc. | VIGI InSight Sx85PI Series Models S385PI, S485PI | <=1.2.0_Build_250827_Rel.66817n |
| TP-Link Systems Inc. | VIGI InSight S655I Series | <=1.1.1_Build_250625_Rel.64224n |
| TP-Link Systems Inc. | VIGI InSight S345‑4G Series | <=2.1.0_Build_250725_Rel.36867n |
| TP-Link Systems Inc. | VIGI InSight Sx25 Series Models S225, S325, S425 | <=1.1.0_Build_250630_Rel.39597n |
DeSpy has not checked any unit, hardware revision or firmware.
Vulnerabilities in this advisory
- CVE-2026-0629 · CWE-287
An authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models allows an attacker on the LAN to reset the admin password without verification by manipulating client-side state. Attackers can gain full administrative access to the device, compromising configuration and network security.
Acknowledgments, as the advisory lists them
- Arko Dhar, Redinent Innovations: reported this vulnerability to CISA
The advisory's legal notice
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
Sources
DeSpy's copy of this version is dated 2026-09-28.
This product uses the NVD API but is not endorsed or certified by the NVD.
CVE records: Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
CISA's Known Exploited Vulnerabilities catalog and CISA Vulnrichment data are CC0 1.0. CISA advisories are shown with the TLP label their document carries. No endorsement by CISA, DHS, NIST or MITRE is stated or implied.