Swann SWIFI-SE2KIC EUVD-2026-99223

The attacker must already have a network position on the same local/adjacent network segment as the SWIFI-SE2KIC camera - for example a device on the home LAN or the camera's Wi-Fi network - and the device must be running firmware 2.0.22 or earlier. Once on that network, no further prerequisites apply: the snapshot function is exposed without any authentication, credentials, or user interaction, so it is exploitable against default configurations. The primary LIMITING factor is this required network adjacency: the flaw is not exploitable directly from the internet unless the camera is deliberately port-forwarded or otherwise exposed externally, which substantially narrows the realistic attacker population to those who have already breached the local network.

This is a moderate, privacy-focused risk rather than a top-tier emergency. The strongest signals are that exploitation requires NO authentication (PR:N), NO user interaction (UI:N), and LOW complexity (AC:L), meaning any attacker with the required network position can trivially pull a snapshot of the camera's live feed - a direct confidentiality breach (VC:H) of an inherently sensitive data source. However, several factors cap the real-world severity: the input CVSS 4.0 score is only 6.9 (medium), there is NO EPSS probability, NO CISA KEV listing, and NO public exploit provided, so this is 'no public exploit identified at time of analysis' and should not be treated as actively exploited. CONFLICT TO VERIFY: the description explicitly states the attacker must be 'on the local network' (adjacent/LAN position), yet the provided CVSS vector uses AV:L (Local), not AV:A (Adjacent) - these are inconsistent; AV:A is the better fit for a LAN-reachable snapshot endpoint, and this discrepancy should be verified with the vendor/ICS-CERT. Impact is limited to confidentiality of the video feed only (VI:N/VA:N) - no code execution, tampering, or denial of service - so overall this is a meaningful privacy/surveillance-exposure issue that warrants patching, but not an internet-wide, remotely-wormable crisis.

An attacker who has gained a foothold on the same local network as the camera (e.g., via a compromised IoT device, a guest Wi-Fi network, or a rogue access point) sends an unauthenticated request to the device's snapshot function and receives a still image of the live video feed, breaching the occupant's privacy. Because no authentication, credentials, or user interaction are required (PR:N/UI:N/AC:L), the request succeeds against a default configuration. No public proof-of-concept was provided in the source data.