Missing Authentication Vulnerabilities in Swann SWIFI‑SE2KIC Cameras (CVE‑2026‑107605 – CVE‑2026‑107607) Allow Unauthenticated Video Access
What It Is – Swann Communications disclosed three critical‑severity flaws in the firmware of its SWIFI‑SE2KIC IP cameras (versions ≤ 2.0.22). The vulnerabilities are “Missing Authentication for Critical Function” bugs that let an attacker on the same network view live video streams without any credentials.
Exploitability – The flaws are publicly listed with a CVSS v3 base score of 6.2 (moderate). No public exploit code has been released, but the attack requires only network proximity, making exploitation feasible in poorly segmented environments.
Affected Products – Swann Communications SWIFI‑SE2KIC cameras, firmware ≤ 2.0.22 (global deployments, commercial‑facility focus).
Why It Matters for Trust & Control Assurance
- Access‑control assurance – Unauthenticated video access demonstrates a gap in the “authentication for critical functions” control objective, a control that maps to many frameworks (e.g., NIST CSF 2.0 PR.AC‑1).
- Continuous monitoring – Detecting unauthorized camera access requires logging and network‑traffic monitoring, providing evidence of due‑diligence for auditors.
- Defensible audit trail – Remediating the flaw and documenting the change creates verifiable proof that the organization enforces proper authentication controls, a key trust signal for enterprise buyers.
Recommended Actions
- Upgrade all SWIFI‑SE2KIC devices to the vendor‑released firmware > 2.0.22.
- Segregate camera networks behind firewalls and disable internet‑facing RTSP ports.
- Enforce strict network‑segmentation policies and enable logging of all camera‑related traffic.
- Validate that authentication mechanisms are enforced for every video‑streaming endpoint.
- Document the remediation steps in your control‑evidence repository for audit readiness.
Source: CISA Advisory ICS‑A‑26‑286‑02