Cross site request forgery (csrf)

2020-02-2415:15:00

PRIOn knowledge base

www.prio-n.com

9.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.7%

JSON

In MIELE XGW 3000 ZigBee Gateway before 2.4.0, a malicious website visited by an authenticated admin user or a malicious mail is allowed to make arbitrary changes in the “admin panel” because there is no CSRF protection.

CPENameOperatorVersion
xgw_3000_zigbee_gateway_firmwarelt2.4.0

CPE	Name	Operator	Version
	xgw_3000_zigbee_gateway_firmware	lt	2.4.0

References

cert.vde.com/en-us/advisories/vde-2019-010