The EH3040 Smart Video Intercom System from Kingdom Communication Associated contains a client-side authentication vulnerability (CWE-602) identified as CVE-2026-89175. This vulnerability enables unauthenticated remote attackers to bypass authentication controls implemented on the client side, granting access to specific pages and partial system configuration data. The issue affects versions prior to 2.5.0A, 2.7.0A, and 2.8.0A. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality. No vendor advisory or patch information is available, and the product is not a cloud service, so remediation depends on vendor updates.

Unauthenticated attackers can bypass client-side authentication controls to access certain pages and obtain partial system configuration information. This could potentially expose sensitive configuration details that might aid further attacks or reconnaissance. The impact is limited to information disclosure with low confidentiality impact as per the CVSS vector. There is no indication of privilege escalation, integrity, or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor for vendor updates. Until a fix is available, restricting network access to the device and limiting exposure to untrusted networks may reduce risk.