CVE-2019-11061
Critical
Description
A broken access control vulnerability in HG100 firmware versions up to 4.00.06 allows an attacker in the same local area network to control IoT devices that connect with itself via http://[target]/smarthome/devicecontrol without any authentication. CVSS 3.0 base score 10 (Confidentiality, Integrity and Availability impacts). CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
SeverityCritical
CVSS10.0
Exploit probability—
ProductAsus Hg100 Firmware
PublishedAug 29, 2019
First seenAug 29, 2019
How to fix
Update
- asus hg100_firmware4.00.09 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| asus hg100_firmware | v < 4.00.09 | 4.00.09 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.