Successful exploitation of these vulnerabilities, discovered by researcher Elliott Phillips, could allow an attacker to view video information without authentication.
Swann Communications SWIFI-SE2KIC is the Swann EVO 2K Indoor Wi-Fi Camera, a plug-in smart security camera designed for residential and small business indoor surveillance.
The following versions of Swann Communications SWIFI-SE2KIC suffer from the vulnerabilities: SWIFI-SE2KIC firmware up to and including version 2.0.22.
In one issue, SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a missing authentication for critical function vulnerability that could allow an attacker on the local network to view live video feed without authentication.
CVE-2026-107605 is the case number for the vulnerability, which as a CVSS V3 base score of 6.2. There is also a V4 base score of 5.9.
Additionally, SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a missing authentication for critical function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication.
CVE-2026-107606 is the case number for the vulnerability, which as a CVSS V3 base score of 6.2. There is also a V4 base score of 6.9.
Also, SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a missing authentication for critical function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication.
CVE-2026-107607 is the case number for the vulnerability, which as a CVSS V3 base score of 6.2. There is also a V4 base score of 6.9.
The product sees use mainly in the commercial facilities sector, and on a global basis.
No exploit currently targets these vulnerabilities. These vulnerabilities are not exploitable remotely.
In terms of mitigations, Australia-based Swann Communications has provided the following interim security measures. For more information, click on Swann Communications.
For suggested mitigations, Swann said to:
- Keep the camera behind a secured router and firewall
- Avoid exposing RTSP services to the Internet through port forwarding, DMZ configurations, or direct public IP access
- Ensure the router and associated accounts use strong, unique passwords
- Keep device firmware updated when new releases become available