CVE-2026-107607: Swann SWIFI-SE2KIC Missing Auth (pending)
noindex and left out of the sitemap until more data is confirmed.CVE-2026-107607 is a missing-authentication flaw in Swann Communications' SWIFI-SE2KIC Wi-Fi camera that lets an attacker on the same local network access a real-time video stream without credentials; NVD has not yet completed its own CVSS scoring or CPE mapping, so this page stays noindex until that analysis is published, and the vendor has not yet listed a fixed firmware version.
Vulnerability summary
| Vulnerability ID | CVE-2026-107607 |
|---|---|
| CVSS score | Not yet scored by NVD |
| EPSS score | 0.00187 |
| CISA KEV | No |
| Source | NVD |
| Published | 2026-10-13T19:18:02.247 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| Swann Communications SWIFI-SE2KIC | — | Firmware 2.0.22 and prior; no fixed version listed by the vendor as of 2026-10-22; not yet a published NVD CPE applicability statement |
What this means
CVE-2026-107607 is a missing authentication for critical function flaw (CWE-306) in SWIFI-SE2KIC, a consumer Wi-Fi security camera from Swann Communications, an Australian commercial-facilities product vendor with worldwide distribution. NVD's description states that firmware "2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication" (NVD).
NVD tracks the CVE with status "Awaiting Analysis" as of 2026-10-22: the only CVSS data on record is the CISA ICS-CERT-submitted score — CVSS v3.1 6.2 (medium), vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, and CVSS v4.0 6.9 (medium) — with no NVD-published independent score or CPE applicability statement yet, so this page leaves cvss_score unset rather than presenting that figure as NVD-confirmed (NVD).
CISA's ICS advisory ICSA-26-286-02, published 2026-10-13, bundles CVE-2026-107607 with two related missing-authentication flaws in the same camera (CVE-2026-107605, unauthenticated live-feed viewing; CVE-2026-107606, unauthenticated snapshot retrieval), credits researcher Elliott Phillips, and states the issue is not exploitable remotely — an attacker needs local network access — with no known public exploitation reported. CISA lists no fixed firmware version and instead gives interim mitigations: keep the camera behind a secured router and firewall, avoid exposing RTSP services via port forwarding, DMZ or a public IP, use strong unique router and account credentials, and contact Swann support for updates (CISA ICS Advisory ICSA-26-286-02).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-22, and FIRST scores the probability of exploitation at 0.00187 (7.9th percentile) (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity and applicability analysis, and because the vendor has not yet published a fixed firmware version, this page does not yet meet the minimum data bar for indexing and will be revisited once either is published. In the meantime, SWIFI-SE2KIC owners should keep the camera off any network segment reachable from untrusted local devices and never expose its RTSP stream to the internet.
Evidence
- Missing authentication for critical function lets a local-network attacker access the camera's real-time video stream without credentials (CWE-306). — NVD
- NVD status is "Awaiting Analysis" with CISA ICS-CERT-submitted CVSS v3.1 6.2 and CVSS v4.0 6.9; no NVD-published score or CPE configuration as of 2026-10-22. — NVD
- Affects SWIFI-SE2KIC firmware 2.0.22 and prior; no fixed version listed; local-network-only attack, no known public exploitation; bundled with two related unauthenticated-viewing CVEs in the same advisory; interim mitigations given instead of a patch. — CISA ICS Advisory ICSA-26-286-02
- Not present in the CISA KEV catalog as of 2026-10-22. — CISA KEV
- EPSS score is 0.00187 (7.9th percentile) as of 2026-10-21. — FIRST EPSS