Swann SWIFI-SE2KIC camera firmware ≤2.0.22: three missing-authentication flaws (CVE-2026-107605/107606/107607, CVSS 6.2) let anyone on the local network view live video and snapshots; no fixed firmware yet, CISA ICSA-26-286-02

CISA published ICS advisory ICSA-26-286-02 on 13 October 2026 for the Swann Communications SWIFI-SE2KIC, a product of the Australian-headquartered security camera maker. Firmware 2.0.22 and earlier has three missing-authentication flaws (CWE-306). CVE-2026-107605 lets an attacker on the local network view the live video feed without logging in; CVE-2026-107606 lets them retrieve a snapshot of the live feed; and CVE-2026-107607 lets them open a real-time video stream. CISA scores them 6.2 (CVSS 3.1, Medium) and 5.9 to 6.9 (CVSS 4.0). CISA says the flaws are not exploitable remotely and no public exploitation has been reported. The advisory lists no fixed firmware. Swann's interim advice is to keep the camera behind a secured router and firewall, never expose its RTSP service to the internet through port forwarding, DMZ or a public IP, use strong unique router and account passwords, and install firmware updates when they arrive. Elliott Phillips reported the flaws. CISA lists the products as deployed worldwide in commercial facilities; Swann cameras are also common in Australian homes and small businesses.

Product

Swann Communications SWIFI-SE2KIC camera firmware

Versions

Affected: SWIFI-SE2KIC firmware 2.0.22 and earlier. No fixed firmware listed as of 13 Oct 2026.

CVSS

6.2 (CVSS 3.1, CISA); CVSS 4.0 5.9 (CVE-2026-107605) and 6.9 (CVE-2026-107606/107607)

Exploited in Australia?

unknown

Patch to

Owners: keep the camera on a trusted home or office network behind the router firewall, remove any port forwarding, DMZ or UPnP mapping that exposes RTSP, put cameras on a separate guest or IoT network where the router supports it, and change router and app passwords to strong unique ones. Watch Swann's app and support site for a firmware release above 2.0.22 and install it when it ships.

Primary: CISA ICS advisory ICSA-26-286-02 — Swann Communications SWIFI-SE2KIC (13 Oct 2026) · Vendor: Swann Communications support (contact point named in the CISA advisory) · CVE: CVE-2026-107605, CVE-2026-107606, CVE-2026-107607

vulnerabilities australia network