CVE-2019-11063: SmartHome application has a broken access control vulnerability in its Web API Server

Security readout for executives and security teams

ASUS SmartHome deployments using affected Android or iOS app versions can expose home or office IoT control to anyone on the same local network. The issue is broken access control, so no login is required. Business urgency is high where these gateways control physical devices or are present on shared Wi-Fi. Exposure appears limited to environments running ASUS SmartHome Android versions up to 3.0.42_190515 or iOS versions up to 2.0.22 with HG100 gateway-connected IoT devices reachable from the attacker’s local network. Prioritize remediation where ASUS SmartHome controls safety, access, cameras, or business-critical physical devices. The risk is local-network abuse rather than internet-wide exploitation based on the supplied evidence, but compromise could directly affect confidentiality, integrity, and availability of connected devices. Mitigation focus: Check ASUS and TWCERT guidance for fixed versions or retirement instructions.; Upgrade affected ASUS SmartHome Android and iOS apps where supported.; Restrict HG100 and SmartHome device access to trusted segmented networks..

Prepared

May 22, 2026, 06:10 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.