Vulnerability · Published Apr 27, 2022 · Assigned by CERTVDE
CVE-2022-22521Privilege Escalation in Miele Benchmark Programming Tool
High 7.3
In plain English
A high-severity incorrect permission assignment in Benchmark Programming Tool from Miele. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.5%top 55.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Miele Benchmark Programming Tool with versions Prior to 1.2.71, executable files manipulated by attackers are unknowingly executed with users privileges. An attacker with low privileges may trick a user with administrative privileges to execute these binaries as admin.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Miele | Benchmark Programming Tool | 1.2.71 |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
References
- https://www.miele.de/p/miele-benchmark-programming-tool-2296.htm x_refsource_MISC
- 20220427 SEC Consult SA-20220427-0 :: Privilege Escalation in Miele Benchmark Programming Tool mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/166881/Miele-Benchmark-Programming-Tool-1.1.49-1.2.71-Privilege-Escalation.html x_refsource_MISC
- https://cert.vde.com/en/advisories/VDE-2022-015/ x_refsource_CONFIRM