MieleRESTServer -- Miele@home Without Cloud Possible

bencope · November 3, 2025, 5:08pm

No I was trying to use the group ID that I’d already used for my Washing Machine, I don’t recognise it at all. It was definitely brand new, or if it was returned they’d done an extremely good job of repacking it

Yes when I do the network reset it disconnects from the wifi.

Neither of those endpoints seem to exist

miele-rest:~/MieleRESTServer/helpers# curl -v 172.29.18.126:80/Devices/
*   Trying 172.29.18.126:80...
* Connected to 172.29.18.126 (172.29.18.126) port 80
* using HTTP/1.x
> GET /Devices/ HTTP/1.1
> Host: 172.29.18.126
> User-Agent: curl/8.14.1
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 404 Not Found
< Date: Thu, 15 Jan 1970 23:04:00 GMT
< Content-Length:0
< Content-Type: application/vnd.miele.v1+json; charset=utf-8
< 
* Connection #0 to host 172.29.18.126 left intact
miele-rest:~/MieleRESTServer/helpers# curl -v 172.29.18.126:80/Devices/001D63FFFEC7FE50/State
*   Trying 172.29.18.126:80...
* Connected to 172.29.18.126 (172.29.18.126) port 80
* using HTTP/1.x
> GET /Devices/001D63FFFEC7FE50/State HTTP/1.1
> Host: 172.29.18.126
> User-Agent: curl/8.14.1
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 404 Not Found
< Date: Thu, 15 Jan 1970 23:04:08 GMT
< Content-Length:0
< Content-Type: application/vnd.miele.v1+json; charset=utf-8
< 
* Connection #0 to host 172.29.18.126 left intact

akappner · November 3, 2025, 11:59pm

This is extremely odd. What makes it even stranger is that I have almost the same unit as you (the TWD360, as shown in the compatibility list) which I used for the initial development, and it did not have this issue.

I scrutinized the manual for your unit again – my suggestion before giving up on this approach would be to execute the “P00” factory reset, followed by the WiFi-specific reset again. This then exercises all documented reset routines. See attached.

If this doesn’t do it, then we’ll have to assume that the app knows something we don’t, and pull the keys off it. Possible, although somewhat in conflict with the goals of the project which is not to rely on any form of cloud connectivity.

Let me know if it gets you anywhere.

bencope · November 11, 2025, 9:04pm

That’s not worked. Do we have any other options?

akappner · November 16, 2025, 10:48am

Hi,

we have some new oven parameters that we can utilize. If you get the chance, could you go the latest development tree, go into “dop2rs/src” and “cargo run” (requires installed Rust toolchain). This will allow you to generate payloads for all programs.

Available commands are:

*** Program Selection: [“NoProgram”, “DefrostBottom”, “AutoHotAir”, “AutoTopBottomHeat”, “EcoHotAir1”, “EcoHotAir2”, “EcoHotAir”, “RoastAutomatic”, “UniversalCook”, “Grill”, “GrillLarge”, “GrillSmall”, “Descale”, “HotAirPlus”, “IntenseBaking”, “ComboCookGrill”, “ComboCookHotAirPlus”, “ComboCookTopBottom”, “CakeSpecial”, “Microwave”, “MicrowaveRoastAutomatic”, “MicrowaveGrill”, “MicrowaveHotAirPlus”, “MicrowaveFanGrill”, “TopBottomHeat”, “TopHeat”, “Pyrolysis”, “RapidHeat”, “Rinse”, “FanGrill”, “EcoHotAir3”, “BottomHeat”, “KeepWarm”, “DefrostSteam”, “DefrostMicrowave”, “ClimateRoastAutomatic”, “ConvectionBake”, “ConvectionRoast”, “MicrowaveConvectionBake”, “MicrowaveConvectionRoast”, “ClimateHotAirPlus”, “HeatBottom”, “HeatSteam”, “HeatMicrowave”, “CookFish”, “CookMeat”, “CookVegetables”, “ClimateConvectionBake”, “ClimateRoast”, “ClimateHotAirPlus2”, “ClimateIntenseBaking”, “ClimateTopBottomHeat”, “ClimateConvectionRoast”, “Popcorn”, “QuickMicrowave”, “RoastAutomaticRf”, “ConvectionBakeRf”, “GrillRf”, “HotAirPlusRf”, “IntenseBakingRf”, “TopBottomHeatRf”, “TopHeatRf”, “FanGrillRf”, “BottomHeatRf”, “ConvectionRoastRf”, “SteamHeat”, “SteamHold”, “SteamAltitudeAdjust”, “DescaleSoak”, “DescaleRinse”, “SteamResidualWater”, “Rotisserie”, “SousVide”, “SteamDry”, “ClimateIntenseBaking2”, “EcoUniversalCook”, “ClimateTopBottomHeat2”, “ComboCookMicrowave”, “RotisserieLarge”, “RotisserieSmall”, “RotisserieFan”, “AutoRoastAutomatic”, “AutoIntenseBaking”, “AutoBottomHeat”, “AutoTopHeat”, “SabbathTopBottom”, “SabbathBottomHeat”, “AutoSteamCook”, “HydrocleanBottomHeat”, “SoloRf”, “HydrocleanTopBottomHeat”, “HydrocleanUniversalCook”, “DryHotAirPlusWithSteam”, “DrySteamOnly”, “DryGrillWithSteam”]

*** Communications Module: [“None”, “ResetXkm”, “FactoryResetXkm”, “OpenSoftAccessPointEndUser”, “OpenSoftAccessPointCustomerService”, “ShutdownXkm”, “MieleSmartConnect”]

Would appreciate if you could let me know which of these work on your config. (Note that the Rust tool currently only generates the payloads; the Python server is still required to encrypt and send them.)
Best regards

akappner · November 16, 2025, 10:49am

Not yet but I’m working on figuring out a solution. We’ll have to extract it from the app somehow I believe. Trying to see if this can be done from an emulated Android system

schneidair · December 17, 2025, 1:48pm

Hi all

First of all, thanks for your work. Seems like a cool solution to use smart features without the devices with relying on Miele servers.

Unfortunately i’m struggling to setup my WWG 700-60 washer. I’ve never connected it to the Miele App and it is brand new
But there seem to be some things different with my device. There seems only HTTPS active, so I’ve changed the scripts to only use https. Connecting to the WLAN was not an issue:

MieleRESTServer/helpers$ ./provision-wifi.sh 192.168.1.1 wifi.json
--2025-12-17 14:34:44--  https://192.168.1.1/WLAN
Connecting to 192.168.1.1:443... connected.
WARNING: The certificate of ‘192.168.1.1’ is not trusted.
WARNING: The certificate of ‘192.168.1.1’ doesn't have a known issuer.
The certificate's owner does not match hostname ‘192.168.1.1’
HTTP request sent, awaiting response... 200 OK
Length: 90 [application/vnd.miele.v1+json]
Saving to: ‘STDOUT’

-                                                      0%[                                                                                                                    ]       0  --.-KB/s               [
{"Success":{"SSID":"SSID_OF_MY_WLAN"}},
{"Success":{"Sec":"WPA"}},
{"Success":{"Key":"***"}}
-                                                    100%[===================================================================================================================>]      90  --.-KB/s    in 0s

2025-12-17 14:34:45 (67.4 MB/s) - written to stdout [90/90]

But the /Security/Commisioning points are somehow not available. At least it fail to commission the keys, and I always receive 404 errors when writing the keys:

MieleRESTServer/helpers$ ./provision-key.sh 192.168.1.1 keys.json
Trying HTTPS
--2025-12-17 14:34:50--  https://192.168.1.1/Security/Commissioning
Connecting to 192.168.1.1:443... connected.
WARNING: The certificate of ‘192.168.1.1’ is not trusted.
WARNING: The certificate of ‘192.168.1.1’ doesn't have a known issuer.
The certificate's owner does not match hostname ‘192.168.1.1’
HTTP request sent, awaiting response... 404 Not Found
2025-12-17 14:34:51 ERROR 404: Not Found.

I’ve tried the script with the Miele@Home network or with the newly assigned WLAN. But the result is always the same.

But what i also noted is that my device is not publishing its GroupID in the MDNS. All i see is the MAC address:

Any ideas on how to proceed to get this device connected?
How did you identify these endpoints /WLAN /Security/Commissioning in the first place?

akappner · December 18, 2025, 2:07am

@schneidair

Hi,

thanks for the report. I am confused as to why, if the device is connected to your own Wi-FI network, it still has IP 192.168.1.1. Is it possible that you are still connected to the device’s Wi-Fi when you try to access the Commissioning endpoint? If you try to provision the device BEFORE connecting it to its own Wi-Fi, you WILL receive error 404. You have to let the device connect to the Wi-Fi you just configured, connect to that Wi-Fi yourself, and only then run the provision-key script.

Let me know if that works.

schneidair · December 19, 2025, 12:00pm

I did not mentioned that, but i’ve tried multiple scenarios following the wifi configuration.

While the machine is in the “waiting for app” state:

with initial IP over Miele@Home network (as in the log above)
with the IP assigned by my home network

After a Restart of the machine, over the home network:

When selecting a generic washing program
When selecting remote start program
Or in the settings menu displaying the communication state

But all ended with the 404 Error. I also tried deactivating Miele@Home as well as reseting the configuration.
My guess would be that they’ve changed the endpoint to something different that /Security/Commissioning but i don’t know how to verify this theory.

akappner · December 19, 2025, 3:53pm

Since you are prior to a security key getting set, you should be able to point a browser to https://192.168.1.1 and see what comes back. Normally the device will show a list of supported endpoints. Could you post it here?

schneidair · December 20, 2025, 7:46pm

I also get an 404 when trying to access https://192.168.1.1
Seems like my device is quite different.

akappner · December 22, 2025, 6:53am

That’s quite odd. You could possibly have a device with the ominous EK047 module, for which I have a firmware dump that behaves differently but I have never actually seen this module in the real world, hence never even attempted to support it. Does any of the following endpoints return anything other than 404 on your device?

/Ident
/State
/profUser/users
/profUser/roles
/Security/Cloud
/Settings
/profFileTransfer
/profLock
/PROF
/DOP2

Lakini · December 22, 2025, 9:36am

A general thought around a project like this: I’m wondering what’s the critical size where companies like Miele switch from “we’re not going to put effort into blocking the solution used by a few tech people” to “woa, wait, this is making us nervous, we better make some changes to our system/code/… before this gets too much traction and publicity”…

Had a similar experience with the smart gateway of a solar company, where i at least suspect a similar “change of mind”.

mundschenk-at · December 22, 2025, 4:12pm

I kinda doubt it, I don’t think their engineering process allow for such rapid turn-arounds. Also, not enough traction (yet) to realistically get noticed at all. This is not the first time someone reverse-engineered the protocol.

akappner · December 22, 2025, 8:46pm

Not saying this never happens, but don’t really think this is a factor here, mainly because there isn’t anything to gain here by breaking compatibility. Not like my code can unlock hidden features reserved for more expensive models. Also if you look at the compatibility list, it seems that more recent/higher spec models tend to have better compatibility.

@mundschenk-at
Probably not the 1st time, but I’m not aware of any public code that deals with the DOP2 format. If you are, please let me know – still a lot to be learned.

schneidair · December 24, 2025, 9:43am

Unfortunately not a single of the endpoints you’ve listed is accessible. I’ve added the /WLAN as a way to check to ensure everything is working.

#!/bin/bash
MIELEIP="$1"
PROTOCOL=https
# Test the following endpoints by outputting the HTTP response to stdout
TARGETS=(
    /WLAN 
    /Ident
    /State
    /profUser/users
    /profUser/roles
    /Security/Cloud
    /Settings
    /profFileTransfer
    /profLock
    /PROF
    /DOP2curl
)

# check if device is reachable, exit if not
ping -c 1 -W 1 "$MIELEIP" > /dev/null 2>&1
if [ $? -ne 0 ]; then
    echo "Device $MIELEIP is not reachable."
    exit 1
fi  

# testing each endpoint, printing the response
for TARGET in "${TARGETS[@]}"; do
    echo "Testing endpoint: $TARGET"
    curl -k "$PROTOCOL://$MIELEIP$TARGET"
    # do the same with wget
    # wget --no-check-certificate -O - "$PROTOCOL://$MIELEIP$TARGET"
    echo -e "\n"
done

I did a couple of tests and can conclude that

Only https is working, http is never successful
/WLAN is working the initial IP 192.168.1.1 prior and after the commission the WIFI
/WLAN is also working with the IP of my WLAN after commissioning
all other endpoints result in an 404
Once I change anything on the menu of the washer, the server refuses all connections and no read is possible

Testing endpoint: /DOP2curl
curl: (7) Failed to connect to 192.168.188.145 port 443 after 3 ms: Couldn't connect to server

activating/deactivating Miele@Home does switch the WIFI on/off but i never get the server to accept any connection again

mundschenk-at · December 24, 2025, 11:21am

I was mainly talking about Miele@Home XKM 3100W Protokollanalyse - #4 von ctr - Haustechnik - Symcon Community, not sure if those were DOP2 devices already (probably not).

akappner · December 27, 2025, 6:01pm

Thanks for checking. Can you please post a copy of the page in your user manual captioned “Radio Modules”? Or just post the manual?

As an FYI, I could not find your device’s manual on the Miele website, so there does seem to be something unusual with this device.

schneidair · December 29, 2025, 8:27am

As it seems to be a switzerland specific device, there are only manuals in german, french or italian but no english version available.
In the German one, there is only a chapter regarding the licensing of the communication modules on page 88: WWG 700-60 CH - Gebrauchsanweisung

This page references an address http://<ip address>/Licenses which is indeed accessible. But I doubt that this might help with the current situation.

akappner · December 29, 2025, 6:20pm

Thank you. Unfortunately this manual does not specify the type of module this has. As far as the /license endpoint is concerned, I did not even know this endpoint existed. Could you post the output of what it returns? The licenses might give us a clue on how the software is running on your device is different from what we currently have compatibility with.

schneidair · December 29, 2025, 6:49pm

I’ve uploaded the file here Download Licenses.txt | LimeWire as it is too long to post here. Link will only be active for one week.