**Critical Flaw Exposed Over 32 Models of TP-Link VIGI Cameras to Remote Hacking**

In a disturbing revelation, researchers have discovered a critical flaw in TP-Link's VIGI camera series that allowed hackers to remotely take control of surveillance systems. The vulnerability, tracked as CVE-2026-0629 (CVSS score 8.7), affects over 32 models of VIGI C and VIGI InSight cameras, leaving thousands of devices exposed to potential attacks.

The flaw, which has been fixed by TP-Link, allowed attackers on a local network to bypass authentication by exploiting the password recovery feature in the camera's web interface. This enabled them to reset the admin password without any verification and gain full control over the cameras.

"Authentication bypass in the password recovery feature of the local web interface in VIGI cameras allows an attacker on the LAN to reset the admin password without verification by manipulating client-side state," reads the advisory. "Attackers can gain full administrative access to the device, compromising configuration and network security."

TP-Link's VIGI cameras are designed for professional video surveillance (CCTV) applications and cater to business and enterprise users, rather than home consumers. The research was conducted by Arko Dhar from Redinent Innovations, who reported that over 2,500 internet-exposed vulnerable cameras were found in October 2025. He noted that this number is likely a small fraction of the actual total, as he only checked one model.

The implications of such a hack are far-reaching and devastating. Attackers can exploit the flaw to expose live and recorded video footage, enabling them to spy on individuals and organizations. They can also use the compromised cameras to move undetected inside corporate networks, build botnets for DDoS attacks, tamper with evidence, disrupt operations, and create legal and regulatory risks due to privacy violations.

The discovery of this critical flaw serves as a stark reminder of the importance of securing IoT devices, particularly those used in professional settings. It highlights the need for manufacturers to prioritize security and provide timely updates to fix vulnerabilities, as well as the importance of users keeping their devices up-to-date with the latest firmware versions.

Stay vigilant, security enthusiasts! Follow me on Twitter (@securityaffairs) and Facebook (SecurityAffairs) for more news and insights into the world of cybersecurity.