Vulnerability · Published Nov 21, 2022 · Assigned by CERTVDE

CVE-2022-3589Miele: Vulnerability in cloud service used by appWash

High 8.1

In plain English

A high-severity authorization bypass via user-controlled key in appWash from Miele. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.8%top 44.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An API Endpoint used by Miele's "AppWash" MobileApp in all versions was vulnerable to an authorization bypass. A low privileged, remote attacker would have been able to gain read and partial write access to other users data by modifying a small part of a HTTP request sent to the API. Reading or changing the password of another user was not possible, thus no impact to Availability.

Affected products (as reported)

Vendor	Product	Versions
Miele	appWash	all (until October 5th 2022)

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://cert.vde.com/de/advisories/VDE-2022-052/