An attacker who can reach the local web interface of affected TP‑Link VIGI cameras can manipulate the password recovery process to reset the administrator password without any additional verification. This flaw stems from improper authentication handling as defined by CWE‑287, allowing the attacker to gain complete control over device configuration and network security settings. The vulnerability permits unauthorized configuration changes, potential compromise of the camera’s firmware, and exposure of associated network infrastructure.

Multiple VIGI camera models from TP‑Link, including the C230I Mini, C240, C250, C340 2.0 series, C340‑W 2.x series, C340S, C440 2.0 and C440‑W 2.0, C540 2.0, C540‑4G, C540‑W 2.0, C540S / EasyCam C540S, C540V, the Cx20 series (C320/C420), Cx20I 1.0/1.20 series (C220I, C320I, C420I), Cx30 1.0/1.20 series (C230, C330, C430), Cx30I 1.0/1.20 series (C230I, C330I, C430I), Cx40I 1.0/1.20 series (C240I, C340I, C440I), Cx45 series (C345/C445), Cx50 series (C350/C450), Cx55 series (C355/C455), Cx85 series (C385/C485), and various InSight models such as S345‑4G, S655I, Sx25 (S225/S325/S425), Sx45 (S245/S345/S445), Sx45ZI (S245ZI/S345ZI/S445ZI), Sx55 (S355/S455), Sx85 (S285/S385), and Sx85PI (S385PI/S485PI). No specific firmware versions or patch levels are listed, so all versions currently shipping the default local web interface are potentially vulnerable.

The issue carries a high CVSS score of 8.7, indicating a significant impact from a remote attacker with local network access. EPSS scores are below 1%, suggesting a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, and no official exploitation reports are publicly available. An attacker can exploit the weakness by accessing the camera’s local web interface from the same LAN, manipulating client‑side state to trigger the password‑reset function, and thereby obtain unrestricted administrative rights. The vulnerability requires only network proximity and no additional privileges or exploits outside the device.