CVE-2019-11063: SmartHome application has a broken access control vulnerability in its Web API Server
A broken access control vulnerability in SmartHome app (Android versions up to 3.0.42190515, ios versions up to 2.0.22) allows an attacker in the same local area network to list user accounts and control IoT devices that connect with its gateway (HG100) via http://[target]/smarthome/devicecontrol without any authentication. CVSS 3.0 base score 10 (Confidentiality, Integrity and Availability impacts). CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11063?
CVE-2019-11063 is rated as a critical severity vulnerability affecting the SmartHome app.
How do I fix CVE-2019-11063?
To fix CVE-2019-11063, update the SmartHome app on Android to version 3.0.42_190516 or higher and iOS to version 2.0.23 or higher.
Who is affected by CVE-2019-11063?
CVE-2019-11063 affects users of the Asus SmartHome app on Android versions up to 3.0.42_190515 and iOS versions up to 2.0.22.
What type of vulnerability is CVE-2019-11063?
CVE-2019-11063 is a broken access control vulnerability that allows unauthorized access to user accounts.
What can an attacker do with CVE-2019-11063?
An attacker with access to the same local area network can list user accounts and control IoT devices connected to the Asus SmartHome gateway.