VYPR
← All advisories
Unrated severityNVD Advisory· Published Aug 29, 2019· Updated Sep 16, 2024

SmartHome application has a broken access control vulnerability in its Web API Server

CVE-2019-11063

Description

A broken access control vulnerability in SmartHome app (Android versions up to 3.0.42_190515, ios versions up to 2.0.22) allows an attacker in the same local area network to list user accounts and control IoT devices that connect with its gateway (HG100) via http://[target]/smarthome/devicecontrol without any authentication. CVSS 3.0 base score 10 (Confidentiality, Integrity and Availability impacts). CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Huawei/Smarthomellm-fuzzy
    Range: Android <=3.0.42_190515, iOS <=2.0.22
  • ASUS/SmartHome Android appv5
    Range: up to 3.0.42_190515
  • ASUS/SmartHome ios appv5
    Range: up to 2.0.22

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.