EUVD-2026-76000
GHSA-76xr-v7hf-hjj2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, unauthenticated, low complexity; only low confidentiality impact (account names only), no integrity or availability impact.
Primary rating from Vendor (twcert).
CVSS VectorVendor: twcert
Lifecycle Timeline
2DescriptionCVE.org
Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses.
AnalysisAI
User account enumeration via observable response discrepancy (CWE-204) affects Kingdom Communication Associated's Smart Video Intercom System across four product lines (EH3040, EH4200, EH1000B, EH2070). Unauthenticated remote attackers can distinguish valid from invalid usernames by measuring or parsing differences in system responses to authentication or lookup requests, yielding a valid account list without credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions beyond network connectivity to the intercom management web interface - exploitation is unauthenticated (PR:N) and requires no user interaction (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) scores 6.9 but the real-world impact is limited: only low confidentiality impact (valid account names), no integrity or availability compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the TWCERT advisory (https://www.twcert.org.tw/en/cp-139-11199-38e1e-2.html) for firmware update guidance; no specific patched firmware version is present in the available CVE data, so contact Kingdom Communication Associated directly to obtain the latest firmware for models EH3040, EH4200, EH1000B, or EH2070. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Missing brute-force protection in Kingdom Communication Associated's Smart Video Intercom System (models EH3040, EH4200,
Client-side authentication bypass in Kingdom Communication Associated's Smart Video Intercom System (models EH3040, EH42
Same weakness CWE-204 – Observable Response Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today