CVE-2026-89175: Kingdom Communication Associated Smart Video Intercom System client-side authentication bypass

CVE-2026-89175 · Severity: medium · CVSS 5.3 · Published 2026-09-11

Kingdom Communication Associated's Smart Video Intercom System is used for building access control and video communication. An unauthenticated attacker can bypass the system's authentication mechanism to access restricted pages and retrieve partial system configuration information, potentially exposing device settings and enabling further attacks.

Technologies: Kingdom Communication Associated Smart Video Intercom System EH1000B, Kingdom Communication Associated Smart Video Intercom System EH2070, Kingdom Communication Associated Smart Video Intercom System EH3040, Kingdom Communication Associated Smart Video Intercom System EH4200. Vendors: Kingdom Communication Associated.

Quick answers

Is CVE-2026-89175 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-89175 being exploited in the wild.
How severe is CVE-2026-89175?
Medium severity, with a CVSS score of 5.3, published 11 September 2026.
Which products and versions are affected?
Kingdom Communication Associated Smart Video Intercom System EH1000B before 2.7.0A; Kingdom Communication Associated Smart Video Intercom System EH2070 before 2.8.0A; Kingdom Communication Associated Smart Video Intercom System EH3040 before 2.5.0A; Kingdom Communication Associated Smart Video Intercom System EH4200 before 2.5.0A.
Is there a fix for CVE-2026-89175?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-89175 attacked?
It is attacked over the network.
Am I affected by CVE-2026-89175?
Check whether you run Kingdom Communication Associated Smart Video Intercom System EH1000B, Kingdom Communication Associated Smart Video Intercom System EH2070, Kingdom Communication Associated Smart Video Intercom System EH3040 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a client-side authentication vulnerability (CVE-2026-89175) in the Smart Video Intercom System where authentication validation is performed only on the client side, allowing unauthenticated remote attackers to bypass it over the network. The vulnerability is network-reachable and requires no authentication or user interaction; attackers can directly access specific pages and extract partial system configuration values. The root cause is the absence of server-side authentication enforcement, enabling direct access to protected resources. Patches are available: update EH3040 and EH4200 to version 2.5.0A, EH1000B to 2.7.0A, and EH2070 to 2.8.0A.

Affected products

  • Kingdom Communication Associated Smart Video Intercom System EH3040 before 2.5.0A
  • Kingdom Communication Associated Smart Video Intercom System EH4200 before 2.5.0A
  • Kingdom Communication Associated Smart Video Intercom System EH1000B before 2.7.0A
  • Kingdom Communication Associated Smart Video Intercom System EH2070 before 2.8.0A

Timeline

  • 2026-09-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.