CVE-2019-11061: HG100 has a broken access control vulnerability in its Web API Server

Security readout for executives and security teams

ASUS HG100 smart home gateways running affected firmware can let anyone on the same local network control connected IoT devices without logging in. This is a critical business risk where the device exists on office, building, lab, or home networks because compromise does not require credentials or user interaction. Exposure is limited to environments with ASUS HG100 devices on reachable local networks. Internet exposure is not stated in the source bundle. The practical risk rises when guest Wi-Fi, shared office LANs, unmanaged IoT networks, or flat internal networks can reach the HG100 management or Web API service. Treat this as urgent where HG100 devices are present. The issue can allow local-network attackers to control connected IoT devices without credentials, creating operational, privacy, and safety exposure. Prioritize inventory, segmentation, and vendor-supported remediation before broader IoT network changes. Mitigation focus: Check ASUS and TWCERT guidance for fixed firmware or official compensating controls.; Update HG100 firmware if a vendor-supported fixed version is available.; Restrict HG100 access to trusted management networks only..

Prepared

May 22, 2026, 06:10 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.