# October 2026 camera advisories: Swann SWIFI-SE2KIC streams without a login, and EseeCloud has a hard-coded credential > CISA advisories on October 13 and 15, 2026 say Swann SWIFI-SE2KIC cameras on firmware 2.0.22 and earlier let someone on the local network view live video and snapshots without authentication, and that EseeCloud app and firmware versions have a hard-coded credential and a device rebinding flaw, with no response from the EseeCloud vendor. - Canonical URL: https://update.dsesecurity.com/updates/cisa-october-2026-swann-swifi-se2kic-eseecloud-camera-advisories-hard-coded-credential/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-19T00:28:10+00:00 - Modified: 2026-10-19T01:55:08+00:00 - Last reviewed by DSE: 2026-10-19 - Resource type: Briefing - DSE priority: Important - Topics: Cybersecurity, Video Surveillance - Reading time: 2 minutes ## What you need to know CISA advisories on October 13 and 15, 2026 say Swann SWIFI-SE2KIC cameras on firmware 2.0.22 and earlier let someone on the local network view live video and snapshots without authentication, and that EseeCloud app and firmware versions have a hard-coded credential and a device rebinding flaw, with no response from the EseeCloud vendor. ## Potentially affected Homes, small offices and businesses using Swann SWIFI-SE2KIC cameras or cameras managed through the EseeCloud app, and the staff who view them remotely. ## DSE recommendation DSE recommends moving Swann SWIFI-SE2KIC and EseeCloud-managed cameras onto an isolated camera network and planning to replace EseeCloud devices. ## Article CISA advisories on October 13 and 15, 2026 say Swann SWIFI-SE2KIC cameras on firmware 2.0.22 and earlier let someone on the local network view live video and snapshots without authentication, and that EseeCloud app and firmware versions have a hard-coded credential and a device rebinding flaw, with no response from the EseeCloud vendor. ## Source facts CISA advisory [ICSA-26-286-02](https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-02), released October 13, 2026, says Swann Communications SWIFI-SE2KIC cameras on firmware 2.0.22 and earlier have missing-authentication flaws, CVE-2026-107605 through CVE-2026-107607, that let an attacker on the local network view the live feed, retrieve snapshots or access a real-time stream without authentication. It says the flaws are not exploitable remotely and no public exploitation has been reported, and Swann’s interim measures are a secured router and firewall, no RTSP exposure through port forwarding, DMZ or public IP access, strong unique router passwords, and firmware updates when released. Advisory [ICSA-26-288-02](https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02), released October 15, 2026, covers EseeCloud app versions 4.9.6 and earlier and firmware 4.9.86.0 and earlier from Guangzhou Juan IoT Technology, and says the flaws could let an attacker gain control over affected IP cameras. They include a hard-coded credential that can be used to log in to EseeCloud devices, rated 9.8 under CVSS v3, a server flaw that can unbind a device from its owner and rebind it to another account, and an ID enumeration weakness, and the vendor did not respond to CISA’s coordination attempts. For both, CISA’s recommended practices are to keep devices off the internet, behind firewalls and isolated from business networks, and to use updated VPNs when remote access is needed. ## Applicability Use this for any site with Swann SWIFI-SE2KIC cameras or EseeCloud-managed cameras. Check model, app and firmware versions against each advisory, since other models are not listed. ## DSE recommendation DSE recommends moving Swann SWIFI-SE2KIC and EseeCloud-managed cameras onto an isolated camera network and planning to replace EseeCloud devices. Remove port forwarding and DMZ settings for camera streams, keep untrusted devices off the camera network, install fixed Swann firmware when it appears, and prefer business camera platforms with published security support. ## Verification Inventory cameras by brand, model and firmware, confirm RTSP is not reachable from the internet with an external scan, and confirm the camera network cannot reach user devices. ## Official references [CISA ICS Advisory ICSA-26-286-02 — Swann Communications SWIFI-SE2KIC](https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-02). [CISA ICS Advisory ICSA-26-288-02 — Guangzhou Juan IoT Technology EseeCloud](https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02). Reviewed October 19, 2026. ## Primary reference - Name: CISA ICS Advisory ICSA-26-286-02 — Swann Communications SWIFI-SE2KIC - Authority: Cybersecurity and Infrastructure Security Agency - URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-02 - Source publication date: Not stated by the source ## Citation and use Preferred citation: “October 2026 camera advisories: Swann SWIFI-SE2KIC streams without a login, and EseeCloud has a hard-coded credential,” DSE Security, https://update.dsesecurity.com/updates/cisa-october-2026-swann-swifi-se2kic-eseecloud-camera-advisories-hard-coded-credential/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.