October 2026 camera advisories: Swann SWIFI-SE2KIC streams without a login, and EseeCloud has a hard-coded credential

CISA advisories on October 13 and 15, 2026 say Swann SWIFI-SE2KIC cameras on firmware 2.0.22 and earlier let someone on the local network view live video and snapshots without authentication, and that EseeCloud app and firmware versions have a hard-coded credential and a device rebinding flaw, with no response from the EseeCloud vendor.

Source facts

CISA advisory ICSA-26-286-02, released October 13, 2026, says Swann Communications SWIFI-SE2KIC cameras on firmware 2.0.22 and earlier have missing-authentication flaws, CVE-2026-107605 through CVE-2026-107607, that let an attacker on the local network view the live feed, retrieve snapshots or access a real-time stream without authentication. It says the flaws are not exploitable remotely and no public exploitation has been reported, and Swann’s interim measures are a secured router and firewall, no RTSP exposure through port forwarding, DMZ or public IP access, strong unique router passwords, and firmware updates when released.

Advisory ICSA-26-288-02, released October 15, 2026, covers EseeCloud app versions 4.9.6 and earlier and firmware 4.9.86.0 and earlier from Guangzhou Juan IoT Technology, and says the flaws could let an attacker gain control over affected IP cameras. They include a hard-coded credential that can be used to log in to EseeCloud devices, rated 9.8 under CVSS v3, a server flaw that can unbind a device from its owner and rebind it to another account, and an ID enumeration weakness, and the vendor did not respond to CISA’s coordination attempts.

For both, CISA’s recommended practices are to keep devices off the internet, behind firewalls and isolated from business networks, and to use updated VPNs when remote access is needed.

Applicability

Use this for any site with Swann SWIFI-SE2KIC cameras or EseeCloud-managed cameras. Check model, app and firmware versions against each advisory, since other models are not listed.

DSE recommendation

DSE recommends moving Swann SWIFI-SE2KIC and EseeCloud-managed cameras onto an isolated camera network and planning to replace EseeCloud devices. Remove port forwarding and DMZ settings for camera streams, keep untrusted devices off the camera network, install fixed Swann firmware when it appears, and prefer business camera platforms with published security support.

Verification

Inventory cameras by brand, model and firmware, confirm RTSP is not reachable from the internet with an external scan, and confirm the camera network cannot reach user devices.

Official references

CISA ICS Advisory ICSA-26-286-02 — Swann Communications SWIFI-SE2KIC. CISA ICS Advisory ICSA-26-288-02 — Guangzhou Juan IoT Technology EseeCloud. Reviewed October 19, 2026.