Swann SWIFI-SE2KIC CVE-2026-107607

Exploitation requires the attacker to be on the same local network segment as the camera (per the advisory, 'an attacker on the local network') and to reach the device's unauthenticated real-time video streaming function on SWIFI-SE2KIC firmware 2.0.22 or earlier. No credentials, user interaction, or special configuration are needed once network adjacency is achieved - the missing-authentication condition appears to apply to default behavior. The principal limiting factor is network reachability: the attack is not exploitable from the internet as described, so network segmentation, a trusted-only Wi-Fi, and absence of other compromised LAN devices materially reduce real-world risk.

This is a moderate-severity information-disclosure flaw (vendor CVSS 4.0 base 6.9) in the Swann SWIFI-SE2KIC Wi-Fi camera, where missing authentication (CWE-306) exposes a real-time video stream. The vendor vector (AV:L/AC:L/PR:N/UI:N, VC:H only) and the description's phrase 'attacker on the local network' both indicate low attack complexity, no privileges and no user interaction - but they CONFLICT on attack vector: CVSS 4.0 AV:L denotes true local (on-device) access, whereas 'local network' maps to adjacent (AV:A); the AV:L label appears incorrect and should likely be AV:A, which would not change severity much but matters for exposure modeling. Impact is confined to confidentiality (VC:H) with no integrity or availability effect, so this is a privacy/surveillance-bypass issue rather than a device-takeover bug. There is no CISA KEV listing, no public POC, and no EPSS score provided, so there is no signal of active or probable near-term exploitation; the primary mitigating factor is that an attacker must already be on the same LAN/Wi-Fi segment. Net: a real but bounded priority - meaningful for anyone whose camera network is reachable by untrusted parties (shared Wi-Fi, compromised IoT segment), low urgency for well-segmented home deployments.

An attacker who has joined the same local/Wi-Fi network as the camera (e.g., a guest, a neighbor on an open or weakly-secured Wi-Fi, or via another compromised IoT device) connects directly to the camera's streaming endpoint and receives the live video feed without supplying any credentials. No public exploit code has been identified, but the access is trivial given network adjacency and low complexity. This yields covert surveillance of the monitored physical space.