Swann Cameras Vulnerable to Unauthenticated Access, CISA Warns

A recently released advisory from the Cybersecurity and Infrastructure Security Agency (CISA) details significant security vulnerabilities in Swann Communications SWIFI-SE2KIC security cameras, potentially allowing unauthorized access to live video feeds. The vulnerabilities, identified as CVE-2026-107605, CVE-2026-107606, and CVE-2026-107607, impact devices running firmware versions up to and including 2.0.22.

The core issue, consistently identified across all three Common Vulnerabilities and Exposures (CVEs), is a “Missing Authentication for Critical Function,” enabling an attacker on the local network to bypass security measures. Specifically, the advisory states exploitation could allow an attacker to view video information, retrieve snapshots of the feed, and access a real-time video stream—all without authentication. CISA assigns a base severity score of 6.2 (Medium) under CVSS Version 3.1 and 6.9 (Medium) under version 4.0 for these vulnerabilities. These vulnerabilities are not exploitable remotely.

CISA recommends a series of interim mitigation steps for users of affected devices. These include keeping cameras behind a secured router and firewall, avoiding direct internet exposure of RTSP services through port forwarding or DMZ configurations, ensuring strong and unique passwords for router accounts, and maintaining up-to-date device firmware. The advisory directs users to Swann Communications’ support portal for further information and assistance. Elliott Phillips is credited with reporting these vulnerabilities to CISA.

While CISA’s advisory outlines the technical vulnerabilities and recommended mitigations, it does not disclose the total number of SWIFI-SE2KIC cameras currently deployed or potentially affected by these issues. The advisory notes that no public exploitation of these vulnerabilities has been reported to CISA as of the release date, but emphasizes the importance of proactive defense measures. The potential for unauthorized access to video feeds raises concerns for both individual privacy and the security of facilities utilizing these cameras.