CVE-2026-89174 Details
Description
Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts through a large number of login attempts.
A missing brute-force protection vulnerability has been identified in the Smart Video Intercom System by Kingdom Communication Associated. This vulnerability allows unauthenticated remote attackers to gain access to valid accounts by making a large number of login attempts. The issue affects several intercom system models, including the EH3040, EH4200, EH1000B, and EH2070, all prior to their respective latest versions.
Users can update the EH3040 and EH4200 models to version 2.5.0A, the EH1000B model to version 2.7.0A, and the EH2070 model to version 2.8.0A.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 11, 2026CISA-ADP
Assessed Sep 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.twcert.org.tw/en/cp-139-11199-38e1e-2.html | [email protected] | AdvisoryBundleRemedy |
| https://www.twcert.org.tw/tw/cp-132-11198-b8bba-1.html | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kingdom Communication Associated EH3040 | < 2.5.0A |
CPE
Remediation
| |
| Kingdom Communication Associated EH4200 | < 2.5.0A |
CPE
Remediation
| |
| Kingdom Communication Associated EH1000B | < 2.7.0A |
CPE
Remediation
| |
| Kingdom Communication Associated EH2070 | < 2.8.0A |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | CVE Modified | CISA-ADP |
| Sep 11, 2026 | New CVE Received | [email protected] |