CVE-2026-0629: Authentication Bypass in VIGI InSight Sx45 Camera

The impact of CVE-2026-0629 is significant. An attacker who successfully exploits this vulnerability gains full administrative access to the VIGI InSight Sx45 Series Camera. This allows them to modify device settings, access recorded footage, and potentially use the camera as a pivot point to compromise other devices on the same network. The ability to reset the administrator password bypasses standard authentication mechanisms, making it a particularly dangerous vulnerability. The lack of verification during the password recovery process is the root cause, enabling attackers to easily manipulate the system. This is similar to other authentication bypass vulnerabilities where client-side state is not properly validated.

1. Reserved2026-01-06
2. Published2026-01-16
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-0629 is to upgrade the VIGI InSight Sx45 Series Camera to version 3.1.0Build250820_Rel.58873n or later. If an immediate upgrade is not possible due to compatibility issues or system downtime requirements, consider segmenting the camera on a separate VLAN to limit its access to critical network resources. Monitor network traffic for unusual activity related to the password recovery endpoint. While a direct WAF rule is unlikely to be effective, implementing strict network access controls and multi-factor authentication (if supported by the camera) can provide additional layers of defense. After upgrading, confirm the fix by attempting a password recovery from a different network segment and verifying that the process requires proper authentication.