Critical severity · published Dec 20, 2019
CVE-2019-15913
An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices
9.8
CVSS
1.3%
EPSS
No
On KEV
Description
An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices. Because of insecure key transport in ZigBee communication, causing attackers to gain sensitive information and denial of service attack, take over smart home devices, and tamper with messages.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Dgnwg03lm Firmware · MI
All versions, or not specified · source: NVD
MF
Mccgq01lm Firmware · MI
All versions, or not specified · source: NVD
RF
Rtcgq01lm Firmware · MI
All versions, or not specified · source: NVD
WF
Wsdcgq01lm Firmware · MI
All versions, or not specified · source: NVD
ZF
Zncz03lm Firmware · MI
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-15913
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-15913
Exploit
https://github.com/chengcheng227/CVE-POC/blob/master/CVE-2019-15913.md
More from Dgnwg03lm Firmware
7.5
CVE-2019-15915
An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, RTCGQ01LM devices
7.5
CVE-2019-15914
An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices