Description

Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration values.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-11T08:16:48.543Z",
  "pubdate": "2026-09-11T08:16:48.543Z",
  "executiveSummary": "The Kingdom Communication Associated Smart Video Intercom System is affected by a critical client-side authentication vulnerability. This flaw allows unauthenticated, remote attackers to circumvent established security controls and gain unauthorized access to protected system pages.\nBy manipulating client-side logic, an adversary can bypass the authentication handshake, effectively authenticating without valid credentials. The primary impact involves the exposure of sensitive system configuration data, which may include network settings, device identification, or internal operational parameters.\nThe vulnerability resides within the application's authentication enforcement mechanism, which relies on insecure client-side validation rather than server-side verification. This creates a significant risk profile, as the barrier to entry is negligible, requiring no specialized privileges or pre-existing user accounts.\nThe attack is remotely exploitable over the network, making it accessible to any actor capable of reaching the device's web management interface. Given that no interaction from an authenticated user is required, the vulnerability presents a low-complexity, high-impact security risk for deployment environments where the device is accessible via external or untrusted networks.",
  "technicalDetails": "The vulnerability stems from improper authorization enforcement where the Smart Video Intercom System incorrectly delegates authentication status tracking to the client-side environment. Instead of maintaining session state and validating user identity on the server-side, the system relies on local checks—such as client-side scripts, cookies, or hidden form fields—to determine whether a request should be granted access to protected administrative or configuration pages.\nThe root cause is a flaw in the application's access control architecture. The web-based management interface fails to perform server-side verification of authentication tokens or session integrity before rendering sensitive data. An attacker can exploit this by manipulating the browser environment to circumvent client-side redirection or conditional rendering logic that is intended to prevent access to unauthorized users.\nAttack flow: An unauthenticated attacker identifies the target URL of a sensitive configuration page. By inspecting the source code or using browser developer tools, the attacker identifies the JavaScript or client-side condition that checks for a 'logged-in' state. The attacker then crafts a direct HTTP request or modifies the local browser state to mimic a valid session. Because the backend server does not perform an independent validation of the session's authenticity, the request is processed, and the system transmits the sensitive configuration data to the unauthorized requester.\nThis vulnerability effectively reduces the security posture of the intercom system to zero for any attacker with network reachability. The exposure of partial system configuration values can facilitate further attacks, such as reconnaissance for additional vulnerabilities, discovery of internal network topology, or the extraction of credentials if sensitive management information is inadvertently included in the configuration payload.\nThe vulnerability is inherent to the product's design, specifically within the logic handling requests for administrative interfaces. Because the system lacks a server-side state machine to validate authentication assertions, there is no technical barrier to stop an attacker from accessing these endpoints repeatedly. The lack of server-side validation ensures that the system is susceptible to automated scanning and bulk data extraction tools, significantly increasing the potential for mass exploitation."
}