SWIFI-SE2KIC CVE-2026-107605

Exploitation requires the attacker to have network-layer reachability to the camera - specifically presence on the same local/Wi-Fi network as the device (the description states 'an attacker on the local network'), which is a meaningful limiting factor: the device is not exploitable directly from the internet in a default deployment unless the owner has exposed it. The affected feature is the live video stream function, which lacks any authentication check (CWE-306), so no credentials or user interaction are needed once network access exists. The CVSS 4.0 AT:P metric indicates a specific attack requirement/condition must be met (e.g., the attacker must reach the correct stream endpoint/service state). Affected scope is firmware versions 2.0.22 and prior on the SWIFI-SE2KIC; devices updated beyond 2.0.22 (per vendor fix) are not affected. Primary limiting factors for defenders: required network adjacency and absence of any remote (internet) vector by default.

This is a medium-severity information-disclosure flaw (CVSS 4.0 base 5.9) whose real-world risk is constrained primarily by access requirements rather than exploit difficulty. The strongest signal is the impact profile: PR:N (no authentication) combined with VC:H (high confidentiality impact) means any attacker who reaches the device can view a live private video feed with no credentials - a meaningful privacy breach for a security camera. However, the attack vector sharply limits exposure: the provided CVSS 4.0 vector states AV:L (Local) and AT:P (an attack requirement/condition present), while the description says the attacker must be 'on the local network,' which in CVSS terms is Adjacent (AV:A) rather than true Local - these two signals conflict and should be verified against the CISA advisory, but both agree the attacker cannot reach the device from the open internet by default. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active or automatable mass exploitation. Net assessment: this is a legitimate privacy/confidentiality issue for affected camera owners but not an urgent internet-wide emergency - it is a priority mainly where the device shares an untrusted LAN (e.g., shared Wi-Fi, IoT segments reachable by a compromised host), not a high-CVSS-but-overhyped remote RCE. No integrity or availability impact (VI:N/VA:N) further caps the blast radius to unauthorized viewing.

An attacker who has gained a foothold on the same local or Wi-Fi network as a Swann SWIFI-SE2KIC camera (e.g., via a guest network, compromised IoT device, or shared residential/office LAN) directly requests the device's video stream endpoint, which fails to enforce authentication, and watches the live feed. No credentials, phishing, or user interaction are required once network adjacency is achieved. No public proof-of-concept exploit has been identified at time of analysis, so exploitation would rely on an attacker independently discovering the unauthenticated stream endpoint.