CVE-2019-11060: high-severity vulnerability in ASUS HG100 firmware
HG100 contains an Uncontrolled Resource Consumption vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The ASUS HG100 router's web server can be knocked offline by an attacker sending HTTP requests very slowly, keeping connections open and exhausting the device's resources until it stops responding to legitimate users.
The web API server on port 8080 in ASUS HG100 firmware ≤1.05.12 is vulnerable to Slowloris HTTP DoS attacks (CWE-400: Uncontrolled Resource Consumption). An unauthenticated attacker on the adjacent network can send HTTP headers at a slow rate to exhaust connection resources and cause service unavailability. CVSS 3.0 score 7.4 reflects high availability impact with low attack complexity.
In the same product, most dangerous first.