CVE-2026-0629CWE-287

Authentication Bypass in Password Recovery Feature via Local Web App on Multiple VIGI Cameras

High · published January 16, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
35.1
In the wild
Unconfirmed
What it is

Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models allows an attacker on the LAN to reset the admin password without verification by manipulating client-side state. Attackers can gain full administrative access to the device, compromising configuration and network security.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00419 · 35.1th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-01-16T17:24Z
EPSS history
Timeline
  • 16 JAN 17:24Z
    Authentication Bypass in Password Recovery Feature via Local Web App on Multiple VIGI Cameras
    cvelistv5