Eh4200
Monthly
Missing brute-force protection in Kingdom Communication Associated's Smart Video Intercom System (models EH3040, EH4200, EH1000B, EH2070) allows unauthenticated remote attackers to systematically guess credentials across all login attempts without rate-limiting or account lockout. Successful credential compromise grants access to valid accounts, exposing video surveillance feeds and intercom functionality. No public exploit code or active exploitation has been identified at time of analysis, but the trivial attack mechanics and high confidentiality impact make this a significant risk for internet-exposed deployments.
Client-side authentication bypass in Kingdom Communication Associated's Smart Video Intercom System (models EH3040, EH4200, EH1000B, EH2070) exposes configuration data to unauthenticated remote attackers. The authentication gate is enforced only in client-side code rather than on the server, allowing direct traversal to restricted pages without supplying credentials. An attacker with network access to the device's web interface can retrieve partial system configuration values - including likely network and device settings - without any login. No public exploit or active exploitation has been identified at time of analysis.
User account enumeration via observable response discrepancy (CWE-204) affects Kingdom Communication Associated's Smart Video Intercom System across four product lines (EH3040, EH4200, EH1000B, EH2070). Unauthenticated remote attackers can distinguish valid from invalid usernames by measuring or parsing differences in system responses to authentication or lookup requests, yielding a valid account list without credentials. No public exploit code or KEV listing has been identified; the practical impact is limited to reconnaissance - harvested account names enable targeted credential attacks such as password spraying or brute force against the intercom management interface.
Missing brute-force protection in Kingdom Communication Associated's Smart Video Intercom System (models EH3040, EH4200, EH1000B, EH2070) allows unauthenticated remote attackers to systematically guess credentials across all login attempts without rate-limiting or account lockout. Successful credential compromise grants access to valid accounts, exposing video surveillance feeds and intercom functionality. No public exploit code or active exploitation has been identified at time of analysis, but the trivial attack mechanics and high confidentiality impact make this a significant risk for internet-exposed deployments.
Client-side authentication bypass in Kingdom Communication Associated's Smart Video Intercom System (models EH3040, EH4200, EH1000B, EH2070) exposes configuration data to unauthenticated remote attackers. The authentication gate is enforced only in client-side code rather than on the server, allowing direct traversal to restricted pages without supplying credentials. An attacker with network access to the device's web interface can retrieve partial system configuration values - including likely network and device settings - without any login. No public exploit or active exploitation has been identified at time of analysis.
User account enumeration via observable response discrepancy (CWE-204) affects Kingdom Communication Associated's Smart Video Intercom System across four product lines (EH3040, EH4200, EH1000B, EH2070). Unauthenticated remote attackers can distinguish valid from invalid usernames by measuring or parsing differences in system responses to authentication or lookup requests, yielding a valid account list without credentials. No public exploit code or KEV listing has been identified; the practical impact is limited to reconnaissance - harvested account names enable targeted credential attacks such as password spraying or brute force against the intercom management interface.