CVE-2019-11061
📋 TL;DR
CVE-2019-11061 is a critical authentication bypass vulnerability in HG100 firmware that allows attackers on the same local network to control connected IoT devices without credentials. This affects all HG100 firmware versions up to 4.00.06, enabling complete device takeover.
💻 Affected Systems
- ASUS HG100 Smart Home Gateway
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all IoT devices connected to the vulnerable HG100 gateway, allowing attackers to manipulate devices (lights, locks, sensors), steal data, or cause physical damage through malicious control.
Likely Case
Unauthorized control of smart home devices by attackers on the same network, potentially leading to privacy violations, property damage, or disruption of home automation systems.
If Mitigated
Limited impact if network segmentation isolates the HG100 from untrusted devices and external networks, though local attackers could still exploit if they gain network access.
🎯 Exploit Status
Public exploit code available on GitHub; exploitation requires only HTTP requests to the vulnerable endpoint without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 4.00.07 or later
Vendor Advisory: https://www.asus.com/support/FAQ/1044144/
Restart Required: Yes
Instructions:
1. Log into HG100 admin interface 2. Navigate to Firmware Update section 3. Download latest firmware from ASUS support site 4. Upload and apply update 5. Reboot device after update completes
🔧 Temporary Workarounds
Network Segmentation
allIsolate HG100 and connected IoT devices on separate VLAN from general user devices
Access Control Lists
linuxRestrict HTTP access to HG100 management interface to trusted IP addresses only
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Disconnect HG100 from network if not essential; use alternative smart home controller
- Implement strict network segmentation to isolate HG100 from all untrusted devices
🔍 How to Verify
Check if Vulnerable:
Check firmware version in HG100 web interface; if version is 4.00.06 or lower, device is vulnerableCheck Version:
curl -s http://[hg100-ip]/cgi-bin/get_firmware_versionVerify Fix Applied:
Confirm firmware version is 4.00.07 or higher in admin interface; test that /smarthome/devicecontrol endpoint now requires authentication📡 Detection & Monitoring
Log Indicators:
- Unauthenticated HTTP POST requests to /smarthome/devicecontrol endpoint
- Multiple device control commands from unfamiliar IP addresses
Network Indicators:
- HTTP traffic to HG100 port 80 from unexpected internal IPs
- Unusual device control patterns in smart home network traffic
SIEM Query:
source="hg100-logs" AND (url="/smarthome/devicecontrol" AND NOT user_authenticated=true)