CVE-2019-11061

Name of the Vulnerable Software and Affected Versions HG100 firmware versions up to 4.00.06

Description A broken access control issue allows an attacker in the same local area network to control IoT devices without authentication by accessing the http://[target]/smarthome/devicecontrol endpoint.

Recommendations For HG100 firmware versions up to 4.00.06, update to a version later than 4.00.06 to resolve the issue. As a temporary workaround, consider restricting access to the http://[target]/smarthome/devicecontrol endpoint to minimize the risk of exploitation.