CVE-2026-0629: TP-Link Systems Inc Vigi c230i Mini

High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days.

Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models allows an attacker on the LAN to reset the admin password without verification by manipulating client-side state. Attackers can gain full administrative access to the device, compromising configuration and network security.

Affected products

  • TP-Link Systems Inc Vigi c230i Mini: before 2.1.0_Build_250701_Rel.47570n (fixed in 2.1.0_Build_250701_Rel.47570n)
  • TP-Link Systems Inc Vigi c240 1.0: before 2.1.0_Build_250701_Rel.48425n (fixed in 2.1.0_Build_250701_Rel.48425n)
  • TP-Link Systems Inc Vigi c250: before 2.1.0_Build_250702_Rel.54301n (fixed in 2.1.0_Build_250702_Rel.54301n)
  • TP-Link Systems Inc Vigi c340-W 2.x Series c340-W 2.0/c340-W 2.20: before 2.1.1_Build_250717_Rel.66528n (fixed in 2.1.1_Build_250717_Rel.66528n)
  • TP-Link Systems Inc Vigi c340 2.0: before 2.1.0_Build_250701_Rel.49304n (fixed in 2.1.0_Build_250701_Rel.49304n)
  • TP-Link Systems Inc Vigi c340s: before 3.1.0_Build_250625_Rel.65381n (fixed in 3.1.0_Build_250625_Rel.65381n)
  • TP-Link Systems Inc Vigi c440-W 2.0: before 2.1.1_Build_250717_Rel.66632n (fixed in 2.1.1_Build_250717_Rel.66632n)
  • TP-Link Systems Inc Vigi c440 2.0: before 2.1.0_Build_250701_Rel.49778n (fixed in 2.1.0_Build_250701_Rel.49778n)
  • TP-Link Systems Inc Vigi c540-4g: before 2.2.0_Build_250826_Rel.56808n (fixed in 2.2.0_Build_250826_Rel.56808n)
  • TP-Link Systems Inc Vigi c540-W 2.0: before 2.1.1_Build_250717_Rel.67730n (fixed in 2.1.1_Build_250717_Rel.67730n)
  • TP-Link Systems Inc Vigi c540 2.0: before 2.1.0_Build_250701_Rel.50397n (fixed in 2.1.0_Build_250701_Rel.50397n)
  • TP-Link Systems Inc Vigi c540s / Easycam c540s: before 3.1.0_Build_250625_Rel.66601n (fixed in 3.1.0_Build_250625_Rel.66601n)
  • TP-Link Systems Inc Vigi c540v: before 2.1.0_Build_250702_Rel.54300n (fixed in 2.1.0_Build_250702_Rel.54300n)
  • TP-Link Systems Inc Vigi CX20 Series c320/c420: before 2.1.0_Build_250701_Rel.39597n (fixed in 2.1.0_Build_250701_Rel.39597n)
  • TP-Link Systems Inc Vigi CX20I 1.0 Series c220i 1.0/c320i 1.0/c420i 1.0: before 2.1.0_Build_251014_Rel.58331n (fixed in 2.1.0_Build_251014_Rel.58331n)
  • TP-Link Systems Inc Vigi CX20I 1.20 Series c220i 1.20/c320i 1.20/c420i 1.20: before 2.1.0_Build_250701_Rel.44071n (fixed in 2.1.0_Build_250701_Rel.44071n)
  • TP-Link Systems Inc Vigi CX30 1.0 Series c230 1.0/c330 1.0/c430 1.0: before 2.1.0_Build_250701_Rel.46796n (fixed in 2.1.0_Build_250701_Rel.46796n)
  • TP-Link Systems Inc Vigi CX30 1.20 Series c230 1.20/c330 1.20/c430 1.20: before 2.1.0_Build_250701_Rel.46796n (fixed in 2.1.0_Build_250701_Rel.46796n)
  • TP-Link Systems Inc Vigi CX30I 1.0 Series c230i 1.0/c330i 1.0/c430i 1.0: before 2.1.0_Build_250701_Rel.45506n (fixed in 2.1.0_Build_250701_Rel.45506n)
  • TP-Link Systems Inc Vigi CX30I 1.20 Series c230i 1.20/c330i 1.20/c430i 1.20: before 2.1.0_Build_250701_Rel.44555n (fixed in 2.1.0_Build_250701_Rel.44555n)
  • TP-Link Systems Inc Vigi CX40I 1.0 Series c240i 1.0/c340i 1.0/c440i 1.0: before 2.1.0_Build_250701_Rel.46003n (fixed in 2.1.0_Build_250701_Rel.46003n)
  • TP-Link Systems Inc Vigi CX40I 1.20 Series c240i 1.20/c340i 1.20/c440i 1.20: before 2.1.0_Build_250701_Rel.45041n (fixed in 2.1.0_Build_250701_Rel.45041n)
  • TP-Link Systems Inc Vigi CX45 Series c345/c445: before 3.1.0_Build_250820_Rel.57668n (fixed in 3.1.0_Build_250820_Rel.57668n)
  • TP-Link Systems Inc Vigi CX50 Series c350/c450: before 2.1.0_Build_250702_Rel.54294n (fixed in 2.1.0_Build_250702_Rel.54294n)
  • TP-Link Systems Inc Vigi CX55 Series c355/c455: before 3.1.0_Build_250820_Rel.58873n (fixed in 3.1.0_Build_250820_Rel.58873n)
  • and 9 more

Published 2026-01-16. Last modified 2026-06-17.