CVE-2026-89175: Smart Video Intercom Auth Bypass Vulnerability

CVE-2026-89175 Overview

CVE-2026-89175 is a client-side authentication vulnerability [CWE-602] affecting the Smart Video Intercom System developed by Kingdom Communication Associated. The flaw allows unauthenticated remote attackers to bypass authentication checks and access restricted pages. Successful exploitation exposes partial system configuration values to attackers over the network.

The vulnerability stems from enforcing authentication logic on the client side rather than validating requests on the server. Attackers can bypass browser-side controls and directly request protected resources without valid credentials.

Critical Impact
Unauthenticated network-based attackers can bypass authentication and retrieve partial system configuration data from affected Smart Video Intercom deployments.

Affected Products

Smart Video Intercom System by Kingdom Communication Associated
Deployments exposing the web management interface over the network
Installations relying on client-side authentication controls

Discovery Timeline

2026-09-11 - CVE-2026-89175 published to NVD
2026-09-11 - Last updated in NVD database
Advisories published by Taiwan CERT Security Advisory and Taiwan CERT Incident Report

Technical Details for CVE-2026-89175

Vulnerability Analysis

The Smart Video Intercom System enforces access restrictions using client-side logic. Authentication decisions occur in the browser rather than on the backend server. Attackers who craft direct HTTP requests to protected endpoints bypass these controls entirely.

This design flaw maps to [CWE-602]: Client-Side Enforcement of Server-Side Security. The server trusts the client to determine whether a request is authorized. Since attackers control their own HTTP client, they can skip login redirects and JavaScript checks and reach restricted pages directly.

The impact is limited to confidentiality of partial system configuration data. Integrity and availability of the intercom system remain unaffected. However, disclosed configuration values may aid follow-on attacks against the device or connected infrastructure.

Root Cause

The root cause is trust misplacement between client and server components. Server-side endpoints do not independently validate session tokens or credentials before returning protected resources. The application assumes the client-side wrapper will block unauthorized users.

Attack Vector

Attackers require network access to the intercom's web interface but no credentials or user interaction. An attacker enumerates known application URLs and issues direct HTTP GET requests. Requests to pages that expose configuration values return data without triggering an authentication challenge.

For technical specifics, refer to the Taiwan CERT Security Advisory. No public proof-of-concept exploit is currently available, and the vulnerability is not listed in CISA KEV.

Detection Methods for CVE-2026-89175

Indicators of Compromise

Unauthenticated HTTP requests to administrative or configuration URLs of the Smart Video Intercom web interface.
Access log entries showing HTTP 200 responses on protected pages without a preceding successful login event.
Requests originating from external IP ranges or unexpected geographies targeting the intercom management interface.

Detection Strategies

Review web server access logs for direct requests to configuration endpoints that bypass the login flow.
Correlate authentication events with sensitive-page access to detect requests lacking a valid session.
Deploy network intrusion detection signatures for HTTP requests targeting the intercom's known administrative paths.

Monitoring Recommendations

Continuously monitor perimeter firewalls and reverse proxies for external access attempts to intercom management interfaces.
Alert on repeated 200-response requests to admin URLs from a single source without a prior authenticated session.
Ingest device and network logs into a centralized SIEM to correlate reconnaissance patterns across assets.

How to Mitigate CVE-2026-89175

Immediate Actions Required

Restrict network access to the Smart Video Intercom management interface using firewall rules or VLAN segmentation.
Place the device behind an authenticated reverse proxy that enforces server-side access control before requests reach the intercom.
Contact Kingdom Communication Associated for a patched firmware release and apply it once available.
Audit web server logs for prior unauthorized access to configuration pages.

Patch Information

Refer to the Taiwan CERT Security Advisory for vendor patch details and any updated firmware releases. Confirm the version installed after remediation and validate that protected endpoints return HTTP 401 or 403 when accessed without a valid session.

Workarounds

Block external access to the intercom's HTTP and HTTPS management ports at the network perimeter.
Require VPN access for administrators managing the intercom system remotely.
Deploy a web application firewall to enforce authentication on requests to sensitive URLs.
Disable remote management features that are not required for daily operations.