Vulnerability record · CVE-2019-11061 · published 29 August 2019

CVE-2019-11061: Asus hg100 firmware missing authentication for critical function vulnerability

Asus · Hg100 Firmware

A broken access control vulnerability in HG100 firmware versions up to 4.00.06 allows an attacker in the same local area network to control IoT devices that connect with itself via http://[target]/smarthome/devicecontrol without any authentication. CVSS 3.0 base score 10 (Confidentiality, Integrity and Availability impacts). CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

8.1 CVSS 3.0 High EPSS 4.0% · top 9.9% CWE-306 · Missing authentication for critical function

8.1CVSS 3.0 base score, v2 4.8

4.0%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References, 4 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Hg100 Firmware Asus

References

Link	Tags
http://surl.twcert.org.tw/5df6x	Third Party Advisory
https://github.com/tim124058/ASUS-SmartHome-Exploit/	ExploitThird Party Advisory
https://tvn.twcert.org.tw/taiwanvn/TVN-201906003	ExploitThird Party Advisory
http://surl.twcert.org.tw/5df6x	Third Party Advisory
https://github.com/tim124058/ASUS-SmartHome-Exploit/	ExploitThird Party Advisory
https://tvn.twcert.org.tw/taiwanvn/TVN-201906003	ExploitThird Party Advisory

Track CVE-2019-11061 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-15911Asus hg100 firmware cleartext transmission vulnerabilityAn issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Because of insecure key transport in Z…EPSS 0.84%20 Dec 2019 9.8CVE-2018-11491Asus hg100 firmware improper authentication vulnerabilityASUS HG100 devices with firmware before 1.05.12 allow unauthenticated access, leading to remote command execution.EPSS 6.7%25 Jul 2018 7.5CVE-2019-15910Asus hg100 firmware improper input validation vulnerabilityAn issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Attackers can utilize the "discover Zi…EPSS 1.3%20 Dec 2019 7.5CVE-2019-15912Asus hg100 firmware improper input validation vulnerabilityAn issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Attackers can use the ZigBee trust cen…EPSS 1.3%20 Dec 2019 7.5CVE-2019-11060Asus hg100 firmware uncontrolled resource consumption vulnerabilityThe web api server on Port 8080 of ASUS HG100 firmware up to 1.05.12, which is vulnerable to Slowloris HTTP Denial of Service: an attacker can cause …EPSS 3.0%29 Aug 2019 7.5CVE-2018-11492Asus hg100 firmware vulnerabilityASUS HG100 devices allow denial of service via an IPv4 packet flood.EPSS 11%10 Aug 2018 8.8CVE-2026-67277MikroTik RouterOS btest missing authentication leaks kernel memory and crashes kernelRouterOS accepts a "related" btest connection before the primary session is authenticated, letting an unauthenticated client start an IPv4 UDP test. …KEVEPSS 1.6%analysed5 Sep 2026 8.8CVE-2026-59822LiteLLM MCP endpoint auth bypass via OAuth2 passthrough fallbackLiteLLM's MCP Streamable HTTP endpoint, prior to 1.84.0, let an unauthenticated attacker send a fabricated Authorization header that triggered an OAu…KEVEPSS 0.84%analysed8 Jul 2026

Source: NIST National Vulnerability Database (record CVE-2019-11061), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.