CVE-2026-107605 is a missing-authentication flaw (CWE-306) in the Swann Communications SWIFI-SE2KIC Wi-Fi security camera: an attacker already on the same local network can view the camera's live video feed without logging in or supplying any credentials; NVD lists the issue as awaiting analysis and has not, as of 2026-11-07, published its own CVSS score.
Vulnerability summary
CVSS base score
N/A
No NVD score published as of
EPSS score (FIRST)
0.2%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
No
Not listed
Published
Vulnerability ID: CVE-2026-107605 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Swann Communications SWIFI-SE2KIC Wi-Fi security camera | — | Firmware 2.0.22 and prior; no fixed version identified in the advisory |
What does this mean for affected devices?
CVE-2026-107605 (CWE-306, missing authentication for critical function) affects the Swann Communications SWIFI-SE2KIC Wi-Fi camera. NVD's description states: "SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to view live video feed without authentication" (NVD).
SWIFI-SE2KIC is a physical consumer/commercial Wi-Fi security camera; CISA's advisory lists the Commercial Facilities sector with worldwide deployment and credits researcher Elliott Phillips with reporting the issue directly to CISA (CISA ICS Advisory ICSA-26-286-02).
NVD tracks CVE-2026-107605 with status "Awaiting Analysis" as of 2026-10-16: it records only a CISA-ADP-submitted score (source [email protected]) — CVSS v3.1 6.2 (medium), vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, and CVSS v4.0 5.9 (medium) — both typed Secondary, not NVD's own Primary rating, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed (NVD).
The same advisory discloses two companion flaws with the identical root cause on the same camera: CVE-2026-107606 (unauthenticated retrieval of a live-feed snapshot) and CVE-2026-107607 (unauthenticated access to a real-time video stream); all three share CWE-306 (CISA ICS Advisory ICSA-26-286-02).
CISA's advisory gives no dedicated firmware fix for CVE-2026-107605; it directs Swann customers to "keep the camera behind a secured router and firewall," avoid exposing RTSP services to the internet through port forwarding, DMZ configurations or direct public IP access, use strong unique router and account passwords, and keep firmware updated, and points unresolved questions to Swann support rather than a published vendor advisory (CISA ICS Advisory ICSA-26-286-02).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00187 (8.376th percentile) as of 2026-11-06 (CISA KEV, FIRST EPSS).
NVD has not finished its own severity analysis, and no vendor-patched firmware is identified in the public advisory. In the meantime, SWIFI-SE2KIC owners should keep the camera off any network reachable by untrusted local devices, disable internet exposure of its RTSP service, and watch for a firmware update from Swann.
Evidence
- SWIFI-SE2KIC firmware 2.0.22 and earlier lets an attacker on the local network view the live video feed without authentication (CWE-306). — NVD
- SWIFI-SE2KIC is a physical Wi-Fi security camera; advisory affects the Commercial Facilities sector worldwide; reported by researcher Elliott Phillips directly to CISA. — CISA ICS Advisory ICSA-26-286-02
- NVD status is "Awaiting Analysis" with a CISA-ADP-submitted Secondary CVSS v3.1 6.2 / v4.0 5.9; no NVD-published Primary score as of 2026-10-16. — NVD
- Same advisory discloses companion CVE-2026-107606 (unauthenticated snapshot retrieval) and CVE-2026-107607 (unauthenticated live-stream access), all CWE-306; no dedicated firmware fix given, only network-hardening mitigations (firewall, no RTSP internet exposure, strong passwords). — CISA ICS Advisory ICSA-26-286-02
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00187 (8.376th percentile) as of 2026-11-06. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
What is CVE-2026-107605?
CVE-2026-107605 is a missing-authentication flaw (CWE-306) in the Swann Communications SWIFI-SE2KIC Wi-Fi security camera: an attacker already on the same local network can view the camera's live video feed without logging in or supplying any credentials; NVD lists the issue as awaiting analysis and has not, as of 2026-11-07, published its own CVSS score.
How severe is CVE-2026-107605?
CVE-2026-107605 has no NVD CVSS score published as of 2026-11-10, so this page gives it no severity rating rather than assuming low or high risk.
Is CVE-2026-107605 being actively exploited?
CVE-2026-107605 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. FIRST's EPSS model puts its probability of exploitation at 0.19%.
What is affected by CVE-2026-107605?
CVE-2026-107605 affects Swann Communications SWIFI-SE2KIC Wi-Fi security camera.
Where does this CVE-2026-107605 information come from?
This advisory is based on NVD, CISA ICS Advisory ICSA-26-286-02, CISA KEV, and FIRST EPSS, cited in full in the Sources section above.
Questions about this page?