The EH3040 Smart Video Intercom System by Kingdom Communication Associated contains a sensitive data exposure vulnerability (CWE-204) where unauthenticated remote attackers can enumerate valid user accounts by analyzing differences in system responses. This flaw allows attackers to confirm the existence of user accounts without authentication, potentially aiding further attacks. The CVSS 4.0 base score is 6.9, indicating a medium severity. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.

The vulnerability enables unauthenticated attackers to enumerate valid user accounts on the EH3040 device, potentially facilitating targeted attacks or further exploitation. However, it does not directly allow system compromise or data modification. The impact is limited to information disclosure of user account validity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor vendor communications for updates. Until a fix is available, limit exposure of the device to untrusted networks and consider network-level access controls to reduce attack surface.