CISA published advisory ICSA-26-286-02 on 13 October 2026 for the Swann SWIFI-SE2KIC, which ISSSource identifies as the Swann EVO 2K Indoor Wi-Fi Camera. Firmware 2.0.22 and every earlier version contain three missing-authentication flaws (CWE-306). Someone on the same local network can watch the camera without a password. There is no fixed firmware yet.
What an attacker can get
Each CVE covers a different way into the video:
- CVE-2026-107605: the live video feed.
- CVE-2026-107606: a snapshot of the live feed.
- CVE-2026-107607: a real-time video stream.
All three score 6.2 (medium) in CVSS v3.1. Under CVSS v4.0 the first scores 5.9 and the other two 6.9. The CVSS vectors rate only the confidentiality impact as high: an attacker can see what the camera sees, but the advisory does not describe changing settings or taking over the device. Elliott Phillips reported the flaws to CISA.
How worried to be
CISA says the flaws are not exploitable remotely and that it knows of no public exploitation. The attacker has to be inside your network first: a guest with the Wi-Fi password, an infected laptop, or another compromised smart device. For a camera in a living room or a child's bedroom, that is still an uncomfortable list.
Swann has not published a fixed version. Its interim advice, passed on by CISA, is:
- keep the camera behind a secured router and firewall;
- do not expose RTSP to the internet through port forwarding, a DMZ or a direct public IP address;
- use strong, unique passwords for the router and related accounts;
- install firmware updates when new releases come out.
The RTSP point deserves a check. If you once forwarded a port so you could pull the stream into a recorder or Home Assistant from outside, remove that rule now. Inside the house, a separate VLAN or guest network for cameras and other IoT gear keeps a compromised phone or laptop away from them. If the camera covers a private room, consider unplugging it until Swann ships an update, and keep checking which firmware version it runs.