The EH3040 Smart Video Intercom System by Kingdom Communication Associated suffers from CWE-307, an improper restriction of excessive authentication attempts. This missing brute-force protection enables unauthenticated remote attackers to repeatedly attempt logins without limitation, potentially compromising valid user accounts. The vulnerability is identified as CVE-2026-89174 with a CVSS 4.0 score of 8.7 (high severity), indicating network attack vector, no privileges or user interaction required, and high impact on confidentiality.

Unauthenticated remote attackers can leverage this vulnerability to perform brute-force login attempts, potentially gaining unauthorized access to valid user accounts on the EH3040 device. This compromises the confidentiality of the system and may lead to unauthorized control or data exposure.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, consider implementing external protections such as network-level rate limiting or access controls to reduce brute-force attack exposure.