ByteOS Network

NVD Vulnerability Details :

CVE-2019-11063

Modified

Source-twcert@cert.org.tw

Published At-29 Aug, 2019 | 01:15

Updated At-24 Aug, 2020 | 17:37

A broken access control vulnerability in SmartHome app (Android versions up to 3.0.42_190515, ios versions up to 2.0.22) allows an attacker in the same local area network to list user accounts and control IoT devices that connect with its gateway (HG100) via http://[target]/smarthome/devicecontrol without any authentication. CVSS 3.0 base score 10 (Confidentiality, Integrity and Availability impacts). CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	8.8	HIGH	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.0	10.0	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary	2.0	8.3	HIGH	AV:A/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

ASUS (ASUSTeK Computer Inc.)

>>smarthome>>Versions before 2.0.22(exclusive)

cpe:2.3:a:asus:smarthome:*:*:*:*:*:iphone_os:*:*

ASUS (ASUSTeK Computer Inc.)

>>smarthome>>Versions before 3.0.42_190515(exclusive)

cpe:2.3:a:asus:smarthome:*:*:*:*:*:android:*:*

Weaknesses

CWE ID	Type	Source
CWE-306	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://surl.twcert.org.tw/5LWQJ	twcert@cert.org.tw	Third Party Advisory
https://github.com/tim124058/ASUS-SmartHome-Exploit/	twcert@cert.org.tw	Exploit Third Party Advisory
https://tvn.twcert.org.tw/taiwanvn/TVN-201908014	twcert@cert.org.tw	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History