Swann Communications SWIFI-SE2KIC
Swann SWIFI-SE2KIC firmware through 2.0.22 can expose live video without authentication on the local network.
40
Vulnerability1 · 1 read
CVE-2026-107606
Missing Auth for Live-Feed Snapshot in Swann SWIFI-SE2KIC
- CVSS 4.0
- 6.9 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Swann Communications SWIFI-SE2KIC firmware versions 2.0.22 and earlier have a missing-authentication flaw (CWE-306) on a critical function that returns a snapshot of the live video feed. An attacker who can reach the device on the local network can request that snapshot without credentials, disclosing the camera's current view. Impact is limited to confidentiality of the feed; integrity and availability are not affected, and the issue is scored 6.9 (medium) under CVSS 4.0. Devices running firmware 2.0.22 and prior are affected. The CVE is not in CISA KEV, and no public proof-of-concept is known.
What to do: Install a Swann firmware release newer than 2.0.22 as soon as one is available, and confirm the running version after the update. Until then, keep SWIFI-SE2KIC devices on a trusted LAN segment, block untrusted local hosts from reaching the camera, and do not expose its snapshot or management service beyond that network.
| Product | Affected |
|---|---|
| Swann Communications SWIFI-SE2KIC | firmware 2.0.22 and prior |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication.
- Weakness
- CWE-306
- Vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X