Security Advisory on Authenticated RCE Vulnerability Due to Buffer Overflow on VIGI C385 (CVE-2026-1457)

Vulnerability and Impact Description:

CVE-2026-1457:

An authenticated buffer handling flaw in TP-Link VIGI C385 V1 Web API lacking input sanitization, may allow memory corruption leading to remote code execution. Authenticated attackers may trigger buffer overflow and potentially execute arbitrary code with elevated privileges.

CVSS v4.0 Score: 8.5 / High

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Products/Versions and Fixes:

Recommendations:

We strongly recommend that users with affected devices take the following actions:

1. Download and update to the latest firmware version to fix the vulnerabilities.

EN: https://www.tp-link.com/en/support/download/vigi-c385/v1/#Firmware

KR: https://www.tp-link.com/kr/support/download/vigi-c385/v1/#Firmware

This product is not sold in the US.

Disclaimer:

If you do not take all recommended actions, this vulnerability will remain. TP-Link cannot bear any responsibility for consequences that could have been avoided by following this advisory.