CVE-2026-89174: Kingdom Smart Intercom Auth Bypass Flaw

CVE-2026-89174 Overview

CVE-2026-89174 affects the Smart Video Intercom System developed by Kingdom Communication Associated. The product lacks brute-force protection on its login interface [CWE-307]. Unauthenticated remote attackers can submit large volumes of login attempts against the authentication endpoint to guess valid credentials.

Successful exploitation grants attackers access to legitimate accounts on the intercom system. Because the device is network-accessible and requires no privileges or user interaction, exploitation can be automated at scale. The advisory was published by TWCERT and coordinated with the vendor.

Critical Impact

Remote unauthenticated attackers can compromise valid user accounts on the Smart Video Intercom System through unrestricted, automated credential-guessing attacks.

Affected Products

• Vendor: Kingdom Communication Associated
• Product: Smart Video Intercom System
• Specific affected versions: Not Available in NVD data

Discovery Timeline

• 2026-09-11 - CVE-2026-89174 published to the National Vulnerability Database (NVD)
• 2026-09-11 - Last updated in NVD database
• 2026-09-11 - TWCERT advisories 11198 and 11199 published

Technical Details for CVE-2026-89174

Vulnerability Analysis

The Smart Video Intercom System exposes an authentication interface that does not implement rate limiting, account lockout, or CAPTCHA-style challenges. Attackers can iterate through credential lists without triggering any defensive throttling. The vulnerability is classified as Improper Restriction of Excessive Authentication Attempts [CWE-307].

Because the authentication endpoint is reachable over the network and requires no prior authentication, an attacker only needs connectivity to the device or its management interface. Credential-stuffing attacks using breached password corpora are equally viable, since reused credentials will succeed silently. Once valid credentials are obtained, the attacker inherits whatever access the compromised account holds on the intercom system.

Root Cause

The root cause is the absence of any control that limits the rate or count of failed authentication attempts. The application accepts and processes each login request independently. There is no lockout counter, no exponential backoff, no source-IP throttling, and no secondary challenge on repeated failure.

Attack Vector

The attack vector is entirely network-based and unauthenticated. An attacker sends automated HTTP or protocol-specific login requests against the intercom's authentication endpoint. Standard tools such as hydra, patator, or custom scripts can enumerate passwords against known or default usernames. No user interaction is required on the victim side.

The vulnerability is described in prose only. No verified proof-of-concept code is published in the referenced advisories. See the TWCERT Advisory 11199 for the official technical description.

Detection Methods for CVE-2026-89174

Indicators of Compromise

• High volumes of failed authentication events from a single source IP or from distributed IPs targeting the intercom login endpoint.
• Successful logins immediately preceded by numerous failures for the same account.
• Logins from geographies or ASNs inconsistent with normal facility operations.
• Unexpected configuration changes or new user accounts created on the intercom appliance.

Detection Strategies

• Ingest authentication logs from the intercom system into a centralized SIEM or data lake and correlate failed-to-successful login ratios per account.
• Baseline normal login volume per device and alert on statistical deviations.
• Monitor network traffic to the intercom management interface for repetitive POST requests to authentication URLs.

Monitoring Recommendations

• Enable verbose authentication logging on the Smart Video Intercom System if supported by the firmware.
• Forward web server, reverse proxy, or firewall logs fronting the device to a log aggregation platform.
• Set alert thresholds for more than N failed logins per minute per source IP or per account, tuned to environmental baselines.

How to Mitigate CVE-2026-89174

Immediate Actions Required

• Restrict network access to the intercom's management and login interfaces to trusted administrative VLANs or VPN users only.
• Rotate all account passwords on the device and enforce long, unique, non-reused passwords.
• Review authentication logs for evidence of brute-force activity or unexpected successful logins.
• Contact Kingdom Communication Associated for firmware updates or vendor guidance referenced in the TWCERT advisories.

Patch Information

Refer to the TWCERT Advisory 11199 and TWCERT Advisory 11198 for vendor remediation status. Apply any firmware update issued by Kingdom Communication Associated that introduces authentication throttling or account lockout. Specific patched version numbers were not published in the NVD entry at the time of writing.

Workarounds

• Place the intercom system behind a reverse proxy or web application firewall that enforces rate limiting on the login endpoint.
• Configure network-layer ACLs or firewall rules to permit login traffic only from authorized management hosts.
• Deploy a fail2ban-style IP blocking mechanism on any upstream proxy handling authentication traffic.
• Disable or rename default administrative accounts to reduce the attack surface of username enumeration.

# Example nginx rate-limit configuration for a reverse proxy fronting the intercom login endpoint
http {
    limit_req_zone $binary_remote_addr zone=intercom_login:10m rate=5r/m;

    server {
        listen 443 ssl;
        server_name intercom.example.local;

        location /login {
            limit_req zone=intercom_login burst=3 nodelay;
            limit_req_status 429;
            proxy_pass http://intercom-backend;
        }
    }
}