CVE-2019-20481

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In MIELE XGW 3000 ZigBee Gateway before 2.4.0, the Password Change Function does not require knowledge of the old password. This can be exploited in conjunction with CVE-2019-20480.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cert.vde.com/en-us/advisories/vde-2019-010Third Party Advisory
https://cert.vde.com/en-us/advisories/vde-2019-010Third Party Advisory

Timeline

Published: Feb 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-204835.4An issue was discovered in Viki Vera 4.9.1.26180. An attacker could set a user's last name to an XSS Payload, and read another user's cookie CVE-2019-204848.1An issue was discovered in Viki Vera 4.9.1.26180. A user without access to a project could download or upload project files by opening the P CVE-2019-204855.7qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers t CVE-2019-204866.1An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple pages (setup.cgi and adv_index.htm) within the web management consol CVE-2019-204878.8An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the WNR1000V4 web management console are vulnerable t CVE-2019-204889.8An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the web management interface (setup.cgi) are vulnerab CVE-2019-204899.8An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. The web management interface (setup.cgi) has an authentication bypass and oth CVE-2019-20497.8In SendMediaUpdate and SendFolderUpdate of avrcp_service.cc, there is a possible memory corruption due to a use after free. This could lead CVE-2019-204908.8cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).CVE-2019-204915.4cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508).CVE-2019-204928.8cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).CVE-2019-204936.1cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).