PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-0629 TP-Link Systems Inc. CVE debrief

CVE-2026-0629 is a high-severity authentication bypass in the password recovery feature of TP-Link VIGI cameras’ local web interface. According to the CISA CSAF advisory, an attacker on the LAN can manipulate client-side state to reset the admin password without verification and then obtain full administrative access. TP-Link and CISA list firmware updates as the primary remediation, and the advisory was first published on 2026-02-05 with a metadata correction on 2026-02-11.

Vendor
TP-Link Systems Inc.
Product
VIGI Cx45 Series Models C345, C445
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-05
Original CVE updated
2026-02-11
Advisory published
2026-02-05
Advisory updated
2026-02-11

Who should care

Organizations that operate TP-Link VIGI cameras, especially teams managing devices reachable from internal LANs. Network administrators, physical security teams, and integrators should prioritize this if camera web interfaces are exposed to broad internal access.

Technical summary

The advisory describes an authentication bypass in the password recovery flow of the cameras’ local web interface. The attacker model is adjacent-network (LAN) access: by manipulating client-side state, the attacker can reset the administrator password without verification. That leads to full administrative control of the device, with potential impact to configuration integrity and network security. The supplied CVSS vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, scored 8.8 (High).

Defensive priority

High. Treat as an urgent firmware-and-access-control issue because a LAN attacker can take over administration of affected cameras without prior credentials.

Recommended defensive actions

  • Inventory TP-Link VIGI devices and compare them to the affected model list in the CSAF advisory.
  • Apply the latest firmware from the TP-Link regional download center referenced in the advisory as soon as feasible.
  • Restrict camera management interfaces to trusted hosts or a dedicated management VLAN; avoid broad LAN reachability where possible.
  • Review administrator passwords and camera recovery settings after updating, and check for unexpected configuration changes.
  • Monitor for unauthorized password resets or admin account changes on affected cameras.
  • Use CISA’s ICS recommended practices and defense-in-depth guidance to reduce exposure around network-connected cameras.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-26-036-01 and its revision history. The source metadata lists 32 affected product names across multiple VIGI series, while the description highlights the password recovery issue and LAN attacker model. The remediation text in the advisory directs users to install the latest firmware and provides regional download links plus a TP-Link FAQ advisory page.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-0629 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-0629

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-0629 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-0629

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-036-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-036-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.