# Swann SWIFI-SE2KIC cameras leak video unauthenticated

Published: 2026-10-13 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/daf813ca-bf22-5e7a-b37f-5acac7226c73/swann-swifi-se2kic-cameras-leak-video-unauthenticated

> Three missing-authentication flaws let local attackers view live feeds, snapshots, and streams from Swann SWIFI-SE2KIC cameras without credentials.

CISA published an ICS advisory for Swann Communications' SWIFI-SE2KIC IP camera, firmware version 2.0.22 and earlier, disclosing three Missing Authentication for Critical Function vulnerabilities (CWE-306). CVE-2026-107605 allows a local-network attacker to view the live video feed without authentication, CVE-2026-107606 allows retrieval of a snapshot of the live feed without authentication, and CVE-2026-107607 allows access to the real-time video stream without authentication. All three require local network access and are not remotely exploitable; CISA states no known public exploitation has been reported at this time.

Swann has not released a firmware fix and instead recommends interim mitigations: keep cameras behind a secured router/firewall, avoid exposing RTSP services to the internet via port forwarding, DMZ, or direct public IP, use strong unique passwords for routers and associated accounts, and apply firmware updates when available. CISA's standard ICS guidance also applies — minimize network exposure, isolate control/IoT device networks from business networks, and use VPNs with care for any required remote access. The vulnerabilities were reported to CISA by researcher Elliott Phillips. Given the local-only attack vector, no active exploitation, and the limited impact (unauthorized video viewing rather than control or compromise), this is a lower-urgency consumer/commercial IoT disclosure, but relevant to organizations using these cameras in physically accessible or shared network environments.

## Mentioned in this report

- Vulnerabilities: CVE-2026-107605, CVE-2026-107606, CVE-2026-107607

## Detection guidance (public sample)

### RTSP Stream Access From Command-Line Media or Scripting Tools

ATT&CK: T1040

Detects ffmpeg/ffplay/VLC/curl/Python/PowerShell being pointed at an rtsp:// URL, which is how an unauthenticated IP camera stream (such as the Swann SWIFI-SE2KIC missing-auth flaws) would be pulled from the local network. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: RTSP Stream Access From Command-Line Media or Scripting Tools
description: Detects media or scripting tools launched with an rtsp:// URL, consistent
  with pulling a live feed from an IP camera that has no authentication (e.g. Swann
  SWIFI-SE2KIC CVE-2026-107605/107607). Review whether the user and host are expected
  to view camera streams.
tags:
- attack.collection
- attack.credential-access
- attack.t1040
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \ffmpeg.exe
    - \ffplay.exe
    - \ffprobe.exe
    - \vlc.exe
    - \curl.exe
    - \wget.exe
    - \python.exe
    - \python3.exe
    - \powershell.exe
    - \pwsh.exe
  selection_cmd:
    CommandLine|contains: rtsp://
  condition: selection_img and selection_cmd
falsepositives:
- Security or facilities staff legitimately viewing camera streams with VLC or ffplay
- Video-processing or NVR integration scripts run by administrators
level: low
id: 18445117-a466-5c29-b494-22a381560248
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-02
```

### Scripting or LOLBin Process Connecting to RTSP Port

ATT&CK: T1040

Detects scripting engines and living-off-the-land binaries opening outbound connections to common RTSP ports (554/8554), which may indicate harvesting of unauthenticated camera video or snapshots on the local network. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Scripting or LOLBin Process Connecting to RTSP Port
description: Detects non-media processes such as PowerShell, Python, curl, or script
  hosts initiating connections to RTSP ports 554 or 8554. Cameras with missing authentication
  (e.g. Swann SWIFI-SE2KIC) allow a LAN attacker to pull the live stream this way.
tags:
- attack.collection
- attack.credential-access
- attack.t1040
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort:
    - 554
    - 8554
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \python.exe
    - \python3.exe
    - \curl.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
  condition: selection
falsepositives:
- Administrator scripts that health-check or snapshot cameras on a schedule
- Developers testing RTSP integrations with Python
level: medium
id: c2273b61-6e84-55f7-8fd1-1d6a1a7d4752
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-02
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-02

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/daf813ca-bf22-5e7a-b37f-5acac7226c73/swann-swifi-se2kic-cameras-leak-video-unauthenticated.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup