CVE-2019-11060 in HG100
Summary
by MITRE
The web api server on Port 8080 of ASUS HG100 firmware up to 1.05.12, which is vulnerable to Slowloris HTTP Denial of Service: an attacker can cause a Denial of Service (DoS) by sending headers very slowly to keep HTTP or HTTPS connections and associated resources alive for a long period of time.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 12/07/2023
The vulnerability identified as CVE-2019-11060 affects the web API server component of ASUS HG100 firmware versions up to 1.05.12, specifically operating on port 8080. This represents a critical security flaw that exposes the device to slowloris-type denial of service attacks, where malicious actors can exploit the server's handling of HTTP connections to exhaust available resources and render the service unavailable to legitimate users. The vulnerability stems from insufficient timeout mechanisms and inadequate connection management within the web server implementation, allowing attackers to maintain persistent connections by sending data at extremely slow rates. This weakness enables attackers to consume all available server connections and associated system resources, effectively preventing legitimate requests from being processed.
The technical flaw manifests as a failure in the HTTP server's connection handling logic, where the system does not properly enforce connection timeouts or resource limits for incomplete HTTP requests. This allows attackers to initiate HTTP connections and send headers at deliberately slow intervals, keeping connections open indefinitely while consuming memory and processing resources. The vulnerability aligns with CWE-400, which addresses excessive resource consumption, and specifically demonstrates poor resource management practices in network service implementations. The attack vector involves establishing multiple HTTP connections and maintaining them open by sending headers at rates that prevent the server from automatically closing the connections, thereby depleting the connection pool and exhausting system resources. This approach follows the established patterns described in the ATT&CK framework under T1498, which covers resource exhaustion attacks targeting network services.
The operational impact of this vulnerability is significant for any organization or individual utilizing ASUS HG100 devices with the affected firmware versions, as it can result in complete service disruption and potential business continuity issues. The slowloris attack can be executed with minimal resources and technical expertise, making it particularly dangerous as an attack vector. Affected systems may experience complete unavailability of the web API service on port 8080, preventing legitimate administrative access and potentially impacting connected network infrastructure. The vulnerability affects not only the immediate device functionality but also represents a potential entry point for more sophisticated attacks, as service disruption can be used as a precursor to other malicious activities. Organizations should note that the impact extends beyond simple service interruption to include potential operational risks and increased attack surface exposure.
Mitigation strategies for this vulnerability should prioritize firmware updates to the latest available versions from ASUS, which would contain the necessary patches to address the connection handling flaws. Network administrators should implement connection limiting measures at the firewall level to restrict the number of concurrent connections to port 8080, while also configuring appropriate timeout values for HTTP connections. The implementation of rate limiting and connection tracking mechanisms can help detect and prevent abnormal connection patterns that characterize slowloris attacks. Additionally, monitoring systems should be configured to alert on unusual connection patterns and resource utilization spikes that may indicate an ongoing attack. Organizations should also consider implementing intrusion detection systems that can identify slowloris attack signatures and automatically block malicious traffic patterns. Regular security assessments and vulnerability scanning should be conducted to identify any remaining exposure and ensure that all devices in the network are properly patched and secured. The remediation process should also include network segmentation to limit the impact of potential attacks and reduce the attack surface for affected devices.