Swifi Se2Kic
Monthly
Unauthenticated access to the real-time video streaming function in Swann SWIFI-SE2KIC cameras running firmware version 2.0.22 and earlier allows an attacker positioned on the same local network segment to view live camera footage without credentials or user interaction. The root cause is a missing-authentication weakness (CWE-306) affecting a critical function, rated 6.9 under the vendor's CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N); our independent CVSS 3.1 assessment agrees on the unauthenticated, no-interaction nature of the flaw and limits impact to confidentiality loss (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code was identified at time of analysis and there is no confirmed active exploitation (the CVE is not in CISA KEV); the practical risk is bounded by LAN reachability rather than internet exposure.
Unauthenticated snapshot retrieval in Swann Communications SWIFI-SE2KIC camera firmware 2.0.22 and earlier lets any device already positioned on the same local or adjacent network segment pull a still image of the camera's live video feed without credentials or user interaction. The flaw is a missing-authentication-for-critical-function weakness (CWE-306) in the snapshot endpoint, and the assessed impact is confidentiality-only (C:H with I:N/A:N), so the exposure is a privacy/surveillance-data leak rather than code execution or denial of service. No public exploit code has been identified at time of analysis and the CVE is not tied to confirmed active exploitation; the practical attacker population is narrow because a network foothold on the camera's LAN or Wi-Fi is required, and the device is not reachable from the internet unless it has been deliberately port-forwarded or otherwise exposed.
Swann Communications SWIFI-SE2KIC cameras running firmware 2.0.22 and earlier expose their live video stream without any authentication check, allowing anyone who can reach the device over the local network to view the video feed using no credentials and no user interaction. The vulnerability is rated CVSS 4.0 base 5.9 by the originating CNA, while our independent assessment scores it CVSS 3.1 5.9 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact only and unaffected integrity or availability. Exploitation is constrained by the need for network adjacency to the camera (same LAN or Wi-Fi network); there is no default internet-facing vector, and no CISA KEV listing or public exploit code was identified at time of analysis, so this is a medium-severity information-disclosure issue whose risk is driven by access requirements rather than exploit difficulty.
Unauthenticated access to the real-time video streaming function in Swann SWIFI-SE2KIC cameras running firmware version 2.0.22 and earlier allows an attacker positioned on the same local network segment to view live camera footage without credentials or user interaction. The root cause is a missing-authentication weakness (CWE-306) affecting a critical function, rated 6.9 under the vendor's CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N); our independent CVSS 3.1 assessment agrees on the unauthenticated, no-interaction nature of the flaw and limits impact to confidentiality loss (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code was identified at time of analysis and there is no confirmed active exploitation (the CVE is not in CISA KEV); the practical risk is bounded by LAN reachability rather than internet exposure.
Unauthenticated snapshot retrieval in Swann Communications SWIFI-SE2KIC camera firmware 2.0.22 and earlier lets any device already positioned on the same local or adjacent network segment pull a still image of the camera's live video feed without credentials or user interaction. The flaw is a missing-authentication-for-critical-function weakness (CWE-306) in the snapshot endpoint, and the assessed impact is confidentiality-only (C:H with I:N/A:N), so the exposure is a privacy/surveillance-data leak rather than code execution or denial of service. No public exploit code has been identified at time of analysis and the CVE is not tied to confirmed active exploitation; the practical attacker population is narrow because a network foothold on the camera's LAN or Wi-Fi is required, and the device is not reachable from the internet unless it has been deliberately port-forwarded or otherwise exposed.
Swann Communications SWIFI-SE2KIC cameras running firmware 2.0.22 and earlier expose their live video stream without any authentication check, allowing anyone who can reach the device over the local network to view the video feed using no credentials and no user interaction. The vulnerability is rated CVSS 4.0 base 5.9 by the originating CNA, while our independent assessment scores it CVSS 3.1 5.9 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact only and unaffected integrity or availability. Exploitation is constrained by the need for network adjacency to the camera (same LAN or Wi-Fi network); there is no default internet-facing vector, and no CISA KEV listing or public exploit code was identified at time of analysis, so this is a medium-severity information-disclosure issue whose risk is driven by access requirements rather than exploit difficulty.