Cleartext transmission of sensitive information in Asus products - CVE-2019-15911
Published: January 8, 2020
Vulnerability identifier: #VU24144
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-15911
CWE-ID: CWE-319
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists in devices using ZigBee PRO due to insecure key transport in ZigBee communication. A remote attacker with ability to intercept network traffic can obtain sensitive information, cause the multiple denial of service (DoS) attacks, take over smart home devices and tamper with messages.
Affected software
ASUS HG100
ASUS MW100
ASUS WS-101
ASUS TS-101
ASUS AS-101
ASUS MS-101
ASUS DL-101
ASUS MW100
ASUS WS-101
ASUS TS-101
ASUS AS-101
ASUS MS-101
ASUS DL-101
How to mitigate CVE-2019-15911
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.