Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2019-20481: In MIELE XGW 3000 ZigBee Gateway before 2.4.0, the Password Change Function does not require knowledge of the old password. This can be exploited in conjunction with CVE-2019-20480.
CVE-2019-20481 · published 6 years ago
Summary
In MIELE XGW 3000 ZigBee Gateway before 2.4.0, the Password Change Function does not require knowledge of the old password. This can be exploited in conjunction with CVE-2019-20480.
What to do
- Update miele xgw_3000_zigbee_gateway_firmware to version 2.4.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| miele | xgw_3000_zigbee_gateway_firmware |
< 2.4.0 cpe:2.3:o:miele:xgw_3000_zigbee_gateway_firmware:*:*:*:*:*:*:*:* |
Original advisory text
In MIELE XGW 3000 ZigBee Gateway before 2.4.0, the Password Change Function does not require knowledge of the old password. This can be exploited in conjunction with CVE-2019-20480.
In MIELE XGW 3000 ZigBee Gateway before 2.4.0, the Password Change Function does not require knowledge of the old password. This can be exploited in conjunction with CVE-2019-20480.
References
- https://cert.vde.com/en-us/advisories/vde-2019-010 Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-287Improper Authentication
Timeline
Published24 Feb 2020
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-20481 · NVD
Track software like this
Free during beta