CVE-2018-11492

This vulnerability lets someone send a very large amount of IPv4 network traffic to the HG100 device, overwhelming it so it becomes slow or unavailable. It’s like repeatedly ringing the doorbell nonstop until the office can’t answer anything else—your network can go down even if you’re not being “hacked” to steal data.

This matters if you run a small business network that uses an ASUS HG100 device as your edge/Internet gateway. It’s most risky when the device is reachable from the internet (for example via open inbound ports, port forwarding, or remote management enabled on the WAN). The concern is specifically about being able to reach the device to send flood traffic.

This is AMBER because there is public exploit code available and denial-of-service attacks can be used to knock your network offline. Even though the likelihood prediction is not definitive, you should treat it as an active, practical risk where the device is internet-reachable.

1. Confirm exposure

• Verify whether the ASUS HG100 is used in your network and note its WAN IP setup.
• Determine whether it is directly reachable from the internet:
  • Review router/firewall settings for port forwards to the HG100.
  • Check whether remote management is enabled on the WAN side.
  • If you have access to your edge logs, look for repeated inbound requests hitting the HG100.

2. Check for an official fix

• Check the ASUS support page and firmware update notes for your exact HG100 model.
• Look specifically for references to denial-of-service, IPv4 flooding, or CVE-2018-11492.
• From the available records, no fixed version or patch details are known, so if ASUS does not provide a specific update, continue to Step 3.

3. Apply hardening if no patch is available

• Remove unnecessary port forwards to the HG100.
• Disable remote management from the internet; keep any admin access limited to your internal network.
• Add rate-limiting and/or traffic filtering at your edge firewall (block or throttle suspicious high-rate IPv4 traffic headed to the HG100).
• If possible, place the HG100 behind additional filtering (so it is not directly exposed).

4. Operational monitoring while changes roll out

• Monitor for unusual traffic spikes targeting the HG100 during peak hours or after changes.
• If you see repeated signs of flooding (traffic spikes, device unresponsiveness), tighten filtering and consider swapping to a newer, supported device if ASUS guidance recommends it.

5. Target date / guidance

• KEV listings were not found in CISA KEV for this CVE based on the available findings, so there is no specific CISA “due date” to follow from KEV here.

CVE-2018-11492 is a denial-of-service issue in ASUS HG100 firmware that can be triggered by an IPv4 packet flood (an attacker sends large volumes of IPv4 traffic to exhaust the device’s ability to process network packets). The availability findings indicate no patch/firmware fix details were available in the sources provided, and CISA KEV does not list this CVE. There is public exploit code available (2 known), which raises real-world risk compared with vulnerabilities that only have theoretical proof-of-concept code. Public exploit existence and traffic-flooding nature support the AMBER priority, especially when the HG100 is reachable from the internet. KEV not listed means it is not confirmed as a widely mandated action via KEV in the available findings; press attention is noted as rising but does not equal confirmed exploitation.