Swann SWIFI-SE2KIC cameras leak video unauthenticated
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Three missing-authentication flaws let local attackers view live feeds, snapshots, and streams from Swann SWIFI-SE2KIC cameras without credentials.
CISA published an ICS advisory for Swann Communications' SWIFI-SE2KIC IP camera, firmware version 2.0.22 and earlier, disclosing three Missing Authentication for Critical Function vulnerabilities (CWE-306). CVE-2026-107605 allows a local-network attacker to view the live video feed without authentication, CVE-2026-107606 allows retrieval of a snapshot of the live feed without authentication, and CVE-2026-107607 allows access to the real-time video stream without authentication. All three require local network access and are not remotely exploitable; CISA states no known public exploitation has been reported at this time.
Swann has not released a firmware fix and instead recommends interim mitigations: keep cameras behind a secured router/firewall, avoid exposing RTSP services to the internet via port forwarding, DMZ, or direct public IP, use strong unique passwords for routers and associated accounts, and apply firmware updates when available. CISA's standard ICS guidance also applies — minimize network exposure, isolate control/IoT device networks from business networks, and use VPNs with care for any required remote access. The vulnerabilities were reported to CISA by researcher Elliott Phillips. Given the local-only attack vector, no active exploitation, and the limited impact (unauthorized video viewing rather than control or compromise), this is a lower-urgency consumer/commercial IoT disclosure, but relevant to organizations using these cameras in physically accessible or shared network environments.
Mentioned in this report
Detection guidance
RTSP Stream Access From Command-Line Media or Scripting Tools
Detects ffmpeg/ffplay/VLC/curl/Python/PowerShell being pointed at an rtsp:// URL, which is how an unauthenticated IP camera stream (such as the Swann SWIFI-SE2KIC missing-auth flaws) would be pulled from the local network. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: RTSP Stream Access From Command-Line Media or Scripting Tools
description: Detects media or scripting tools launched with an rtsp:// URL, consistent
with pulling a live feed from an IP camera that has no authentication (e.g. Swann
SWIFI-SE2KIC CVE-2026-107605/107607). Review whether the user and host are expected
to view camera streams.
tags:
- attack.collection
- attack.credential-access
- attack.t1040
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- \ffmpeg.exe
- \ffplay.exe
- \ffprobe.exe
- \vlc.exe
- \curl.exe
- \wget.exe
- \python.exe
- \python3.exe
- \powershell.exe
- \pwsh.exe
selection_cmd:
CommandLine|contains: rtsp://
condition: selection_img and selection_cmd
falsepositives:
- Security or facilities staff legitimately viewing camera streams with VLC or ffplay
- Video-processing or NVR integration scripts run by administrators
level: low
id: 18445117-a466-5c29-b494-22a381560248
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-02
Scripting or LOLBin Process Connecting to RTSP Port
Detects scripting engines and living-off-the-land binaries opening outbound connections to common RTSP ports (554/8554), which may indicate harvesting of unauthenticated camera video or snapshots on the local network. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Scripting or LOLBin Process Connecting to RTSP Port
description: Detects non-media processes such as PowerShell, Python, curl, or script
hosts initiating connections to RTSP ports 554 or 8554. Cameras with missing authentication
(e.g. Swann SWIFI-SE2KIC) allow a LAN attacker to pull the live stream this way.
tags:
- attack.collection
- attack.credential-access
- attack.t1040
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort:
- 554
- 8554
Image|endswith:
- \powershell.exe
- \pwsh.exe
- \python.exe
- \python3.exe
- \curl.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
condition: selection
falsepositives:
- Administrator scripts that health-check or snapshot cameras on a schedule
- Developers testing RTSP integrations with Python
level: medium
id: c2273b61-6e84-55f7-8fd1-1d6a1a7d4752
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-02
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-02
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs