Swann Communications SWIFI-SE2KIC
Swann SWIFI-SE2KIC firmware through 2.0.22 can expose live video without authentication on the local network.
CISA's ICS advisory says Swann Communications SWIFI-SE2KIC firmware 2.0.22 and earlier has three missing-authentication flaws, CVE-2026-107605, CVE-2026-107606, and CVE-2026-107607. An attacker on the local network could view a live feed, retrieve a snapshot, or access a real-time stream without credentials. Each issue is CWE-306 and scores 6.2 medium under CVSS 3.1. Swann's interim guidance is to keep the camera behind a firewall, avoid exposing RTSP to the internet, use strong router passwords, and apply future firmware. The vendor is headquartered in Australia and the product is deployed worldwide.
- Firmware 2.0.22 and earlier lacks authentication for video functions.
- A local-network attacker could view live video, snapshots, or streams.
- All three issues are CWE-306 with CVSS 3.1 base score 6.2.
- Swann advises keeping cameras behind a firewall and not exposing RTSP.
- No active exploitation is reported in the advisory.
- Vendors
- Swann Communications
- Products
- SWIFI-SE2KIC
- Organizations
- CISA
- Countries
- Australia
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-107606+2 related CVEs | Missing Auth for Live-Feed Snapshot in Swann SWIFI-SE2KIC | 6.9 group max | — |
From the original article
5 min read at cisa.govView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to view video information without authentication. The following versions of Swann Communications SWIFI-SE2KIC are affected: SWIFI-SE2KIC firmware <=2. 0.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.