पासवर्ड रिकवरी फ़ीचर में प्रमाणीकरण बाईपास कई VIGI कैमरों पर स्थानीय वेब ऐप के माध्यम से

The impact of CVE-2026-0629 is significant. An attacker who successfully exploits this vulnerability gains full administrative access to the VIGI InSight Sx45 Series Camera. This allows them to modify device settings, access recorded footage, and potentially use the camera as a pivot point to compromise other devices on the same network. The ability to reset the administrator password bypasses standard authentication mechanisms, making it a particularly dangerous vulnerability. The lack of verification during the password recovery process is the root cause, enabling attackers to easily manipulate the system. This is similar to other authentication bypass vulnerabilities where client-side state is not properly validated.

Organizations utilizing VIGI InSight Sx45 Series Cameras in environments with limited network segmentation are particularly at risk. Shared hosting environments where multiple users share the same camera infrastructure are also vulnerable. Legacy configurations that have not been regularly patched or updated are more susceptible to exploitation.

1. 2026-01-16Disclosure

   disclosure

1. आरक्षित2026-01-06
2. प्रकाशित2026-01-16
3. संशोधित2026-02-26
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2026-0629 is to upgrade the VIGI InSight Sx45 Series Camera to version 3.1.0Build250820_Rel.58873n or later. If an immediate upgrade is not possible due to compatibility issues or system downtime requirements, consider segmenting the camera on a separate VLAN to limit its access to critical network resources. Monitor network traffic for unusual activity related to the password recovery endpoint. While a direct WAF rule is unlikely to be effective, implementing strict network access controls and multi-factor authentication (if supported by the camera) can provide additional layers of defense. After upgrading, confirm the fix by attempting a password recovery from a different network segment and verifying that the process requires proper authentication.