CVE-2026-89174: Kingdom Communication Associated Smart Video Intercom System missing brute-force protection

CVE-2026-89174 · Severity: high · CVSS 7.5 · Published 2026-09-11

Kingdom Communication Associated's Smart Video Intercom System is an access control device used to manage entry to buildings and facilities. An unauthenticated attacker can repeatedly guess login credentials without rate limiting, allowing them to gain unauthorized access to legitimate user accounts and bypass security controls protecting the intercom system.

Technologies: Kingdom Communication Associated Smart Video Intercom System EH1000B, Kingdom Communication Associated Smart Video Intercom System EH2070, Kingdom Communication Associated Smart Video Intercom System EH3040, Kingdom Communication Associated Smart Video Intercom System EH4200. Vendors: Kingdom Communication Associated.

Quick answers

Is CVE-2026-89174 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-89174 being exploited in the wild.
How severe is CVE-2026-89174?
High severity, with a CVSS score of 7.5, published 11 September 2026.
Which products and versions are affected?
Kingdom Communication Associated Smart Video Intercom System EH1000B before 2.7.0A; Kingdom Communication Associated Smart Video Intercom System EH2070 before 2.8.0A; Kingdom Communication Associated Smart Video Intercom System EH3040 before 2.5.0A; Kingdom Communication Associated Smart Video Intercom System EH4200 before 2.5.0A.
Is there a fix for CVE-2026-89174?
A patch was published on 2026-09-11: Patches released for all affected models: EH3040/EH4200 v2.5.0A, EH1000B v2.7.0A, EH2070 v2.8.0A Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89174 attacked?
It is attacked over the network.
Am I affected by CVE-2026-89174?
Check whether you run Kingdom Communication Associated Smart Video Intercom System EH1000B, Kingdom Communication Associated Smart Video Intercom System EH2070, Kingdom Communication Associated Smart Video Intercom System EH3040 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a missing brute-force protection flaw affecting the authentication mechanism in the Smart Video Intercom System. Unauthenticated remote attackers can exploit the lack of login attempt rate limiting to perform dictionary or credential-stuffing attacks against valid user accounts. The vulnerability requires network access to the device but no prior authentication or user interaction. Successful exploitation grants an attacker full access to a legitimate account, potentially including system configuration, video/audio streams, and door control functions. Patches are available: update EH3040, EH4200, EH1000B, and EH2070 to versions 2.5.0A, 2.5.0A, 2.7.0A, and 2.8.0A respectively.

Affected products

  • Kingdom Communication Associated Smart Video Intercom System EH3040 before 2.5.0A
  • Kingdom Communication Associated Smart Video Intercom System EH4200 before 2.5.0A
  • Kingdom Communication Associated Smart Video Intercom System EH1000B before 2.7.0A
  • Kingdom Communication Associated Smart Video Intercom System EH2070 before 2.8.0A

Timeline

  • 2026-09-11: disclosed
  • 2026-09-11: patched: Patches released for all affected models: EH3040/EH4200 v2.5.0A, EH1000B v2.7.0A, EH2070 v2.8.0A

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.