SWANN Communications SWIFI-SE2KIC cameras with firmware version 2.0.22 or earlier are implicated in three related vulnerabilities that could allow an attacker on the local network to access live video information without authentication. The issues are listed as Missing Authentication for Critical Function (CWE-306) and are recorded under CVEs CVE-2026-107605, CVE-2026-107606 and CVE-2026-107607. CISA notes that these flaws could enable viewing a live video feed (or snapshots) without providing credentials.
Affected product: Swann Communications SWIFI-SE2KIC firmware <= 2.0.22. The advisory explains that exploitation requires access to the local network, and there is no indication of remote exploitation. The CVSS base scores indicate a medium severity, with CVSSv3.1 and CVSSv4.0 measurements both placing the impact on confidentiality at high but without impact on integrity or availability in some metrics. No known public exploitation has been reported to CISA at this time.
Practical response guidance focuses on mitigating exposure and strengthening network controls. Interim measures include keeping firmware updated when releases are available, placing cameras behind secured routers and firewalls, and avoiding exposure of RTSP services to the internet via port forwarding, DMZs or direct public IP access. Users should maintain strong, unique passwords for routers and accounts and perform standard defensive steps to limit control-system exposure. CISA also reminds organisations to conduct risk assessments before deploying mitigations.