CVE-2026-89173
Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.26%
- CWE
- CWE-204
- Published
- 2026-09-11
- Last modified
- 2026-09-11
Affected products
- Kingdom Communication Associated EH3040
- Kingdom Communication Associated EH4200
- Kingdom Communication Associated EH1000B
- Kingdom Communication Associated EH2070
Weakness type
Related vulnerabilities
- CVE-2026-33419 — MinIO: LDAP login brute-force via user enumeration and missing rate limit
- CVE-2025-5485 — SinoTrack GPS Receiver Weak Authentication
- CVE-2018-25350 — userSpice 4.3.24 Username Enumeration via existingUsernameCheck.php
- CVE-2026-6207 — Observable response discrepancy vulnerability in HAVELSAN Inc. Geographic Tracking System allows System Footprinting. T
- CVE-2026-60007 — In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA P
- CVE-2026-15747 — Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle
- CVE-2021-34580 — Remote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0
- CVE-2025-46390 — CWE-204: Observable Response Discrepancy