Description
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication.
Published: 2026-10-13
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Unauthenticated Local Snapshot Retrieval
Action: Patch Firmware
AI Analysis

Impact

The firmware of SWIFI-SE2KIC cameras before and including 2.0.22 contains a missing authentication flaw that allows a local network attacker to retrieve a live‑feed snapshot without credentials. The vulnerability is classified as CWE‑306. Unauthorized retrieval of a snapshot can expose current events, user activity, or potentially act as a foothold for further surveillance of the premises.

Affected Systems

The affected systems are Swann Communications SWIFI‑SE2KIC security cameras running firmware version 2.0.22 or earlier.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity; the EPSS score is not available, implying unclear exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local network presence, no remote access. An attacker with network access can invoke the unprotected snapshot endpoint to capture the image and gain insight into the monitored area.

Generated by OpenCVE AI on October 13, 2026 at 19:22 UTC.

Remediation

Vendor Workaround

Swann Communications has provided the following interim security measures. For more information, contact Swann Communications https://support.swann.com/hc/en-us/requests/new. * Keep the camera behind a secured router and firewall. * Avoid exposing RTSP services to the internet through port forwarding, DMZ configurations, or direct public IP access. * Ensure the router and associated accounts use strong, unique passwords. * Keep device firmware updated when new releases become available.

OpenCVE Recommended Actions

  • Update the camera firmware to a version released after 2.0.22.
  • Place the camera behind a secured router or firewall to limit local network exposure.
  • Block or restrict inbound RTSP services from being exposed to the internet.
  • Ensure that all router and camera accounts use strong, unique passwords.

Generated by OpenCVE AI on October 13, 2026 at 19:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication.
Title Missing authentication for critical function in Swann Communications SWIFI-SE2KIC
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2026-10-13T18:19:01.096Z

Reserved: 2026-10-08T12:57:46.746Z

Link: CVE-2026-107606

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T19:18:02.090

Modified: 2026-10-13T19:30:29.797

Link: CVE-2026-107606

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T19:30:12Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function