ASUS HG100 Firmware vulnerabilities

7 CVEs affecting ASUS HG100 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-15912, published 2019-12-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-11492, published 2018-08-10. High severity, CVSS 7.5. EPSS: 11.2% chance of exploitation in the next 30 days. ASUS HG100 devices allow denial of service via an IPv4 packet flood.
CVE-2018-11491, published 2018-07-25. Critical severity, CVSS 9.8. EPSS: 6.7% chance of exploitation in the next 30 days. ASUS HG100 devices with firmware before 1.05.12 allow unauthenticated access, leading to remote command execution.
CVE-2019-11061, published 2019-08-29. High severity, CVSS 8.1. EPSS: 4% chance of exploitation in the next 30 days. A broken access control vulnerability in HG100 firmware versions up to 4.00.06 allows an attacker in the same local area network to control IoT devices that connect with itself via…
CVE-2019-11060, published 2019-08-29. High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days. The web api server on Port 8080 of ASUS HG100 firmware up to 1.05.12, which is vulnerable to Slowloris HTTP Denial of Service: an attacker can cause a Denial of Service (DoS) by sending headers very…
CVE-2019-15910, published 2019-12-20. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Attackers can utilize the "discover ZigBee network procedure" to perform a denial of…
CVE-2019-15912, published 2019-12-20. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Attackers can use the ZigBee trust center rejoin procedure to perform mutiple denial of…
CVE-2019-15911, published 2019-12-20. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Because of insecure key transport in ZigBee communication, attackers can obtain…