Three Authentication Bypass Vulnerabilities Discovered in Swann SE2KIC Security Cameras

The Cybersecurity and Infrastructure Security Agency (CISA) has added three CVEs to its Known Exploited Vulnerabilities catalog associated with Swann Communications SWIFI-SE2KIC security camera firmware. According to the advisory published on 2026-10-13, the vulnerabilities stem from a Missing Authentication for Critical Function flaw that could allow a local network attacker to compromise video privacy.

CVE-2026-107605: An attacker on the local network could view the live video feed without authentication.
CVE-2026-107606: An attacker on the local network could retrieve a snapshot of the live feed without authentication.
CVE-2026-107607: An attacker on the local network could access a real-time video stream without authentication.

All three vulnerabilities affect SWIFI-SE2KIC firmware versions 2.0.22 and prior. The vendor has assigned CVSS v3.1 scores of 3.1, 4.0, and varying scores for the three flaws, with base severities rated MEDIUM. The attack vector is local (AV:L) and requires low complexity (AC:L), with no privileges needed (PR:N).

Swann Communications has not released a firmware patch as of the advisory date. The vendor has issued interim mitigations, including keeping the camera behind a secured router and firewall, avoiding exposure of RTSP services to the internet through port forwarding or DMZ configurations, ensuring router and account passwords are strong and unique, and updating firmware when new releases become available. The relevant CWE identifier for all three vulnerabilities is CWE-306.

The advisory notes that these devices are commercially deployed worldwide, with vendor headquarters in Australia. While exploitation requires the attacker to be on the same local network, exposure of RTSP services to the internet significantly increases risk. No public evidence of active in-the-wild exploitation has been reported at the time of the advisory.