جزئیات آسیب‌پذیری

CVE-2026-0629

TP-Link Systems VIGI C230I MiniTP-Link Systems VIGI C240TP-Link Systems VIGI C250TP-Link Systems VIGI C340TP-Link Systems VIGI C340-W 2.x SeriesTP-Link Systems VIGI C340S

Authentication Bypass in Password Recovery Feature via Local Web App on Multiple VIGI Cameras

CVSS 4.0

8.7بالا

شرح رسمی (انگلیسی)

Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models allows an attacker on the LAN to reset the admin password without verification by manipulating client-side state. Attackers can gain full administrative access to the device, compromising configuration and network security.

امتیازهای CVSS

امتیاز	نسخه	منبع	بردار
8.7بالا	4.0	CVEProject cvelistV5 (CNA) (TPLink)	`CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`

محصولات آسیب‌پذیر

فروشنده	محصول	نسخه‌ها	منبع
TP-Link Systems Inc.	VIGI C230I Mini	v < 2.1.0_Build_250701_Rel.47570n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI C240 1.0	v < 2.1.0_Build_250701_Rel.48425n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI C250	v < 2.1.0_Build_250702_Rel.54301n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI C340 2.0	v < 2.1.0_Build_250701_Rel.49304n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI C340-W 2.x Series (C340-W 2.0/C340-W 2.20)	v < 2.1.1_Build_250717_Rel.66528n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI C340S	v < 3.1.0_Build_250625_Rel.65381n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI C440 2.0	v < 2.1.0_Build_250701_Rel.49778n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI C440-W 2.0	v < 2.1.1_Build_250717_Rel.66632n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI C540 2.0	v < 2.1.0_Build_250701_Rel.50397n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI C540-4G	v < 2.2.0_Build_250826_Rel.56808n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI C540-W 2.0	v < 2.1.1_Build_250717_Rel.67730n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI C540S / EasyCam C540S	v < 3.1.0_Build_250625_Rel.66601n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI C540V	v < 2.1.0_Build_250702_Rel.54300n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI Cx20 Series (C320/C420)	v < 2.1.0_Build_250701_Rel.39597n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI Cx20I 1.0 Series (C220I 1.0/C320I 1.0/C420I 1.0)	v < 2.1.0_Build_251014_Rel.58331n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI Cx20I 1.20 Series (C220I 1.20/C320I 1.20/C420I 1.20)	v < 2.1.0_Build_250701_Rel.44071n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI Cx30 1.0 Series (C230 1.0/C330 1.0/C430 1.0)	v < 2.1.0_Build_250701_Rel.46796n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI Cx30 1.20 Series (C230 1.20/C330 1.20/C430 1.20)	v < 2.1.0_Build_250701_Rel.46796n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI Cx30I 1.0 Series (C230I 1.0/C330I 1.0/C430I 1.0)	v < 2.1.0_Build_250701_Rel.45506n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI Cx30I 1.20 Series (C230I 1.20/C330I 1.20/C430I 1.20)	v < 2.1.0_Build_250701_Rel.44555n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI Cx40I 1.0 Series (C240I 1.0/C340I 1.0/C440I 1.0)	v < 2.1.0_Build_250701_Rel.46003n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI Cx40I 1.20 Series (C240I 1.20/C340I 1.20/C440I 1.20)	v < 2.1.0_Build_250701_Rel.45041n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI Cx45 Series (C345/C445)	v < 3.1.0_Build_250820_Rel.57668n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI Cx50 Series (C350/C450)	v < 2.1.0_Build_250702_Rel.54294n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI Cx55 Series (C355/C455)	v < 3.1.0_Build_250820_Rel.58873n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI Cx85 Series (C385/C485)	v < 3.0.2_Build_250630_Rel.71279n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI InSight S345-4G	v < 2.1.0_Build_250725_Rel.36867n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI InSight S655I	v < 1.1.1_Build_250625_Rel.64224n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI InSight Sx25 Series (S225/S325/S425)	v < 1.1.0_Build_250630_Rel.39597n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI InSight Sx45 Series (S245/S345/S445)	v < 3.1.0_Build_250820_Rel.57668n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI InSight Sx45ZI Series (S245ZI/S345ZI/S445ZI)	v < 1.2.0_Build_250820_Rel.60930n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI InSight Sx55 Series (S355/S455)	v < 3.1.0_Build_250820_Rel.58873n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI InSight Sx85 Series (S285/S385)	v < 3.0.2_Build_250630_Rel.71279n	CVEProject cvelistV5 (CNA)
TP-Link Systems Inc.	VIGI InSight Sx85PI Series (S385PI/S485PI)	v < 1.2.0_Build_250827_Rel.66817n	CVEProject cvelistV5 (CNA)

منابع و راهنماها

https://www.vigi.com/us/support/download/ patch
https://www.vigi.com/en/support/download/ patch
https://www.vigi.com/in/support/download/ patch
https://www.tp-link.com/us/support/faq/4906/ vendor-advisory

هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.

اطلاعات

تاریخ انتشار: ۱۴۰۴/۱۰/۲۶
آخرین به‌روزرسانی: ۱۴۰۴/۱۲/۰۷
وضعیت: منتشرشده
صادرکننده (CNA): TPLink

پیش‌بینی بهره‌برداری (EPSS)

۰٫۴۱٪

احتمال بهره‌برداری در ۳۰ روز

۳۶٫۳٪

صدک (نسبت به همه‌ی CVEها)

ارزیابی SSVC (CISA)

قابل خودکارسازی: خیر
وضعیت بهره‌برداری: ندارد
اثر فنی: کامل

ضعف‌ها (CWE)

CWE-287
Improper Authentication