Swann SWIFI-SE2KIC Pre-Auth Video Streaming Disclosure via Multiple CVEs

Vulnerability Overview Vulnerability Name: Swann Communications SWIFI-SE2KIC Release Date: October 13, 2026 Alert Code: ICSA-26-286-02 Related Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Impact Scope Affected Versions: SWIFI-SE2KIC firmware versions <= 2.0.22 CVE Numbers: CVE-2026-107605, CVE-2026-107606, CVE-2026-107607 CVSS Score: v3 6.2 Vendor: Swann Communications Device: SWIFI-SE2KIC Firmware Vulnerability Details 1. CVE-2026-107605: - Description: SWIFI-SE2KIC firmware versions 2.0.22 and earlier contain a "Critical Functionality Missing Authentication" vulnerability, allowing attackers to view live video streams on the local network without authentication. 2. CVE-2026-107606: - Description: SWIFI-SE2KIC firmware versions 2.0.22 and earlier contain a "Critical Functionality Missing Authentication" vulnerability, allowing attackers to capture snapshots of live video streams on the local network without authentication. 3. CVE-2026-107607: - Description: SWIFI-SE2KIC firmware versions 2.0.22 and earlier contain a "Critical Functionality Missing Authentication" vulnerability, allowing attackers to access live video streams on the local network without authentication. Remediation Recommended Practices: - Minimize the network exposure of all control system devices and/or systems, ensuring they are not accessible from the internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - When remote access is required, use more secure communication methods such as Virtual Private Networks (VPNs), and recognize potential VPN vulnerabilities; update to the latest version. - Organizations should conduct appropriate impact analysis and risk assessments before deploying defensive measures. - Implement recommended cybersecurity strategies to proactively defend ICS assets. - Follow internal procedures to report suspicious malicious activities and report findings to CISA for tracking and correlation analysis. - Do not click links in email messages or open attachments to avoid email scams and social engineering attacks. Additional Information Background: - Critical Infrastructure Sector: Commercial Facilities - Deployed Countries/Regions: Global - Company Headquarters Location: Australia Acknowledgments: - Elliott Phillips reported these vulnerabilities to CISA. Revision History Initial Release Date: October 13, 2026 Revision: 1 Summary: Initial Release Tags Sector: Commercial Facilities Sector Topic: Industrial Control System Vulnerabilities, Industrial Control Systems Related Links Related Advisories: - Satel Netco Design - Red Lion Controls N-Tron 700 Series - Grid Protection Alliance openPDC and openHistorian - Hitachi Energy SOI Legal Notice and Terms of Use This product is subject to this notice and the privacy and usage policy. Feedback Please share your thoughts; we recently updated our anonymous product survey, and feedback is welcome. Footer CISA Central: - Phone: 1-844-Say-CISA - Email: contact@cisa.dhs.gov Official Website: - CISA.gov - Official Website of the U.S. Department of Homeland Security Links: - About CISA - Budget and Performance - DHS.gov - FOIA Requests - No FEAR Act - Office of Inspector General - Privacy Policy - Subscribe - The White House - USA.gov - Website Feedback Summary SWIFI-SE2KIC firmware versions 2.0.22 and earlier from Swann Communications contain multiple "Critical Functionality Missing Authentication" vulnerabilities, allowing attackers to view, capture snapshots, or access live video streams on the local network without authentication. It is recommended to implement various defensive measures, including minimizing network exposure, using firewalls and VPNs, conducting risk assessments, and implementing recommended cybersecurity strategies.

Goal Reached Thanks to every supporter — we hit 100%!

Swann SWIFI-SE2KIC Pre-Auth Video Streaming Disclosure via Multiple CVEs