A Swann security camera will stream its live video feed to anyone on your local network, no login required.
CISA has disclosed three vulnerabilities in the Swann SWIFI-SE2KIC camera's firmware, version 2.0.22 and earlier, all stemming from the same root flaw, CWE-306, missing authentication for critical function. CVE-2026-107605 exposes the live video feed, CVE-2026-107606 leaks snapshot images, and CVE-2026-107607 opens the real-time stream, none of them requiring a password. CVSS scores land between 5.9 and 6.9, medium severity, because exploitation requires an attacker to already be on the local network. Researcher Elliott Phillips reported the bugs to CISA.
That local-network caveat sounds reassuring until you remember how porous home networks actually are: shared guest Wi-Fi, compromised routers, and smart-home devices that all trust each other by default. Missing-authentication bugs like this keep turning up in consumer IoT cameras, and they keep landing in the same place: a device that assumes anyone who can reach it is allowed to look through it.
CISA's remediation list is really just advice to hide the problem: keep the camera behind a firewall, don't expose it to the internet, use strong router passwords. No firmware fix is mentioned. For a camera meant to watch your home, isolate it better isn't much of an answer.