CVE-2019-20480: Miele Xgw 3000 Zigbee Gateway Firmware

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

In MIELE XGW 3000 ZigBee Gateway before 2.4.0, a malicious website visited by an authenticated admin user or a malicious mail is allowed to make arbitrary changes in the "admin panel" because there is no CSRF protection.

Affected products

• Miele Xgw 3000 Zigbee Gateway Firmware: before 2.4.0 (fixed in 2.4.0)

Published 2020-02-24. Last modified 2026-06-17.