CISA advisories on October 13 and 15, 2026 say Swann SWIFI-SE2KIC cameras on firmware 2.0.22 and earlier let someone on the local network view live video and snapshots without authentication, and that EseeCloud app and firmware versions have a hard-coded credential and a device rebinding flaw, with no response from the EseeCloud vendor.
\nCISA advisory ICSA-26-286-02, released October 13, 2026, says Swann Communications SWIFI-SE2KIC cameras on firmware 2.0.22 and earlier have missing-authentication flaws, CVE-2026-107605 through CVE-2026-107607, that let an attacker on the local network view the live feed, retrieve snapshots or access a real-time stream without authentication. It says the flaws are not exploitable remotely and no public exploitation has been reported, and Swann’s interim measures are a secured router and firewall, no RTSP exposure through port forwarding, DMZ or public IP access, strong unique router passwords, and firmware updates when released.
\nAdvisory ICSA-26-288-02, released October 15, 2026, covers EseeCloud app versions 4.9.6 and earlier and firmware 4.9.86.0 and earlier from Guangzhou Juan IoT Technology, and says the flaws could let an attacker gain control over affected IP cameras. They include a hard-coded credential that can be used to log in to EseeCloud devices, rated 9.8 under CVSS v3, a server flaw that can unbind a device from its owner and rebind it to another account, and an ID enumeration weakness, and the vendor did not respond to CISA’s coordination attempts.
\nFor both, CISA’s recommended practices are to keep devices off the internet, behind firewalls and isolated from business networks, and to use updated VPNs when remote access is needed.
\nUse this for any site with Swann SWIFI-SE2KIC cameras or EseeCloud-managed cameras. Check model, app and firmware versions against each advisory, since other models are not listed.
\nDSE recommends moving Swann SWIFI-SE2KIC and EseeCloud-managed cameras onto an isolated camera network and planning to replace EseeCloud devices. Remove port forwarding and DMZ settings for camera streams, keep untrusted devices off the camera network, install fixed Swann firmware when it appears, and prefer business camera platforms with published security support.
\nInventory cameras by brand, model and firmware, confirm RTSP is not reachable from the internet with an external scan, and confirm the camera network cannot reach user devices.
\nCISA ICS Advisory ICSA-26-286-02 — Swann Communications SWIFI-SE2KIC. CISA ICS Advisory ICSA-26-288-02 — Guangzhou Juan IoT Technology EseeCloud. Reviewed October 19, 2026.
", "content_text": "CISA advisories on October 13 and 15, 2026 say Swann SWIFI-SE2KIC cameras on firmware 2.0.22 and earlier let someone on the local network view live video and snapshots without authentication, and that EseeCloud app and firmware versions have a hard-coded credential and a device rebinding flaw, with no response from the EseeCloud vendor.\nSource facts\nCISA advisory ICSA-26-286-02, released October 13, 2026, says Swann Communications SWIFI-SE2KIC cameras on firmware 2.0.22 and earlier have missing-authentication flaws, CVE-2026-107605 through CVE-2026-107607, that let an attacker on the local network view the live feed, retrieve snapshots or access a real-time stream without authentication. It says the flaws are not exploitable remotely and no public exploitation has been reported, and Swann’s interim measures are a secured router and firewall, no RTSP exposure through port forwarding, DMZ or public IP access, strong unique router passwords, and firmware updates when released.\nAdvisory ICSA-26-288-02, released October 15, 2026, covers EseeCloud app versions 4.9.6 and earlier and firmware 4.9.86.0 and earlier from Guangzhou Juan IoT Technology, and says the flaws could let an attacker gain control over affected IP cameras. They include a hard-coded credential that can be used to log in to EseeCloud devices, rated 9.8 under CVSS v3, a server flaw that can unbind a device from its owner and rebind it to another account, and an ID enumeration weakness, and the vendor did not respond to CISA’s coordination attempts.\nFor both, CISA’s recommended practices are to keep devices off the internet, behind firewalls and isolated from business networks, and to use updated VPNs when remote access is needed.\nApplicability\nUse this for any site with Swann SWIFI-SE2KIC cameras or EseeCloud-managed cameras. Check model, app and firmware versions against each advisory, since other models are not listed.\nDSE recommendation\nDSE recommends moving Swann SWIFI-SE2KIC and EseeCloud-managed cameras onto an isolated camera network and planning to replace EseeCloud devices. Remove port forwarding and DMZ settings for camera streams, keep untrusted devices off the camera network, install fixed Swann firmware when it appears, and prefer business camera platforms with published security support.\nVerification\nInventory cameras by brand, model and firmware, confirm RTSP is not reachable from the internet with an external scan, and confirm the camera network cannot reach user devices.\nOfficial references\nCISA ICS Advisory ICSA-26-286-02 — Swann Communications SWIFI-SE2KIC. CISA ICS Advisory ICSA-26-288-02 — Guangzhou Juan IoT Technology EseeCloud. Reviewed October 19, 2026.", "content_markdown": "CISA advisories on October 13 and 15, 2026 say Swann SWIFI-SE2KIC cameras on firmware 2.0.22 and earlier let someone on the local network view live video and snapshots without authentication, and that EseeCloud app and firmware versions have a hard-coded credential and a device rebinding flaw, with no response from the EseeCloud vendor.\n\n## Source facts\n\nCISA advisory [ICSA-26-286-02](https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-02), released October 13, 2026, says Swann Communications SWIFI-SE2KIC cameras on firmware 2.0.22 and earlier have missing-authentication flaws, CVE-2026-107605 through CVE-2026-107607, that let an attacker on the local network view the live feed, retrieve snapshots or access a real-time stream without authentication. It says the flaws are not exploitable remotely and no public exploitation has been reported, and Swann’s interim measures are a secured router and firewall, no RTSP exposure through port forwarding, DMZ or public IP access, strong unique router passwords, and firmware updates when released.\n\nAdvisory [ICSA-26-288-02](https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02), released October 15, 2026, covers EseeCloud app versions 4.9.6 and earlier and firmware 4.9.86.0 and earlier from Guangzhou Juan IoT Technology, and says the flaws could let an attacker gain control over affected IP cameras. They include a hard-coded credential that can be used to log in to EseeCloud devices, rated 9.8 under CVSS v3, a server flaw that can unbind a device from its owner and rebind it to another account, and an ID enumeration weakness, and the vendor did not respond to CISA’s coordination attempts.\n\nFor both, CISA’s recommended practices are to keep devices off the internet, behind firewalls and isolated from business networks, and to use updated VPNs when remote access is needed.\n\n## Applicability\n\nUse this for any site with Swann SWIFI-SE2KIC cameras or EseeCloud-managed cameras. Check model, app and firmware versions against each advisory, since other models are not listed.\n\n## DSE recommendation\n\nDSE recommends moving Swann SWIFI-SE2KIC and EseeCloud-managed cameras onto an isolated camera network and planning to replace EseeCloud devices. Remove port forwarding and DMZ settings for camera streams, keep untrusted devices off the camera network, install fixed Swann firmware when it appears, and prefer business camera platforms with published security support.\n\n## Verification\n\nInventory cameras by brand, model and firmware, confirm RTSP is not reachable from the internet with an external scan, and confirm the camera network cannot reach user devices.\n\n## Official references\n\n[CISA ICS Advisory ICSA-26-286-02 — Swann Communications SWIFI-SE2KIC](https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-02). [CISA ICS Advisory ICSA-26-288-02 — Guangzhou Juan IoT Technology EseeCloud](https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02). Reviewed October 19, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/cisa-october-2026-swann-swifi-se2kic-eseecloud-camera-advisories-hard-coded-credential/", "url": "https://update.dsesecurity.com/updates/cisa-october-2026-swann-swifi-se2kic-eseecloud-camera-advisories-hard-coded-credential/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-19" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/cisa-october-2026-swann-swifi-se2kic-eseecloud-camera-advisories-hard-coded-credential/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "October 2026 camera advisories: Swann SWIFI-SE2KIC streams without a login, and EseeCloud has a hard-coded credential", "item": "https://update.dsesecurity.com/updates/cisa-october-2026-swann-swifi-se2kic-eseecloud-camera-advisories-hard-coded-credential/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/cisa-october-2026-swann-swifi-se2kic-eseecloud-camera-advisories-hard-coded-credential/#article", "identifier": "https://update.dsesecurity.com/updates/cisa-october-2026-swann-swifi-se2kic-eseecloud-camera-advisories-hard-coded-credential/", "url": "https://update.dsesecurity.com/updates/cisa-october-2026-swann-swifi-se2kic-eseecloud-camera-advisories-hard-coded-credential/", "headline": "October 2026 camera advisories: Swann SWIFI-SE2KIC streams without a login, and EseeCloud has a hard-coded credential", "description": "CISA advisories on October 13 and 15, 2026 say Swann SWIFI-SE2KIC cameras on firmware 2.0.22 and earlier let someone on the local network view live…", "abstract": "CISA advisories on October 13 and 15, 2026 say Swann SWIFI-SE2KIC cameras on firmware 2.0.22 and earlier let someone on the local network view live video and snapshots without authentication, and that EseeCloud app and firmware versions have a hard-coded credential and a device rebinding flaw, with no response from the EseeCloud vendor.", "articleBody": "CISA advisories on October 13 and 15, 2026 say Swann SWIFI-SE2KIC cameras on firmware 2.0.22 and earlier let someone on the local network view live video and snapshots without authentication, and that EseeCloud app and firmware versions have a hard-coded credential and a device rebinding flaw, with no response from the EseeCloud vendor.\nSource facts\nCISA advisory ICSA-26-286-02, released October 13, 2026, says Swann Communications SWIFI-SE2KIC cameras on firmware 2.0.22 and earlier have missing-authentication flaws, CVE-2026-107605 through CVE-2026-107607, that let an attacker on the local network view the live feed, retrieve snapshots or access a real-time stream without authentication. It says the flaws are not exploitable remotely and no public exploitation has been reported, and Swann’s interim measures are a secured router and firewall, no RTSP exposure through port forwarding, DMZ or public IP access, strong unique router passwords, and firmware updates when released.\nAdvisory ICSA-26-288-02, released October 15, 2026, covers EseeCloud app versions 4.9.6 and earlier and firmware 4.9.86.0 and earlier from Guangzhou Juan IoT Technology, and says the flaws could let an attacker gain control over affected IP cameras. They include a hard-coded credential that can be used to log in to EseeCloud devices, rated 9.8 under CVSS v3, a server flaw that can unbind a device from its owner and rebind it to another account, and an ID enumeration weakness, and the vendor did not respond to CISA’s coordination attempts.\nFor both, CISA’s recommended practices are to keep devices off the internet, behind firewalls and isolated from business networks, and to use updated VPNs when remote access is needed.\nApplicability\nUse this for any site with Swann SWIFI-SE2KIC cameras or EseeCloud-managed cameras. Check model, app and firmware versions against each advisory, since other models are not listed.\nDSE recommendation\nDSE recommends moving Swann SWIFI-SE2KIC and EseeCloud-managed cameras onto an isolated camera network and planning to replace EseeCloud devices. Remove port forwarding and DMZ settings for camera streams, keep untrusted devices off the camera network, install fixed Swann firmware when it appears, and prefer business camera platforms with published security support.\nVerification\nInventory cameras by brand, model and firmware, confirm RTSP is not reachable from the internet with an external scan, and confirm the camera network cannot reach user devices.\nOfficial references\nCISA ICS Advisory ICSA-26-286-02 — Swann Communications SWIFI-SE2KIC. CISA ICS Advisory ICSA-26-288-02 — Guangzhou Juan IoT Technology EseeCloud. Reviewed October 19, 2026.", "datePublished": "2026-10-19T00:28:10+00:00", "dateModified": "2026-10-19T01:55:08+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/cisa-october-2026-swann-swifi-se2kic-eseecloud-camera-advisories-hard-coded-credential/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/cisa-october-2026-swann-swifi-se2kic-eseecloud-camera-advisories-hard-coded-credential/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "October 2026 camera advisories: Swann SWIFI-SE2KIC streams without a login, and EseeCloud has a hard-coded credential" }, "articleSection": [ "Cybersecurity", "Video Surveillance" ], "keywords": [ "Cybersecurity", "Video Surveillance", "Briefing", "Important priority" ], "genre": "Briefing", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Video Surveillance", "url": "https://update.dsesecurity.com/topic/video-surveillance/" } ], "wordCount": 398, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "CISA ICS Advisory ICSA-26-286-02 — Swann Communications SWIFI-SE2KIC", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-02" } } ] } }