Smart Video Intercom Missing Brute-Force Protection Flaw

CVE-2026-89174 exposes a critical authentication weakness in Kingdom Communication Associated's Smart Video Intercom System. The vulnerability stems from missing brute-force protection mechanisms (CWE-307), allowing unauthenticated remote attackers to systematically guess valid credentials through unlimited login attempts. This affects any organization deploying these intercoms for physical security—from office buildings and residential complexes to healthcare facilities and government installations. Since video intercom systems control access to restricted areas, successful compromise creates direct physical security breaches alongside data exposure risks.

While this CVE lacks explicit MITRE ATT&CK technique mapping, Casky's 754 security skills trained on Claude AI would detect the underlying attack patterns through extended reasoning analysis. Practitioners using Casky would identify findings aligned with T1110 (Brute Force) and T1078 (Valid Accounts), observing behavioral indicators such as: repeated failed authentication attempts from external IPs, account lockout patterns that never trigger, authentication logs showing systematic username/password combinations, and successful logins following suspicious attempt clusters. The platform's reasoning engine would correlate these anomalies across logs to surface the missing rate-limiting controls and absent account lockout thresholds, enabling security teams to recognize exploitation attempts in real-time and recommend immediate compensating controls like network-based login throttling or WAF rate-limiting rules.