CVE-2022-22521

In Miele Benchmark Programming Tool with versions Prior to 1.2.71, executable files manipulated by attackers are unknowingly executed with users privileges. An attacker with low privileges may trick a user with administrative privileges to execute these binaries as admin.

• CWE-732
• CWE-732

• http://packetstormsecurity.com/files/166881/Miele-Benchmark-Programming-Tool-1.1.49-1.2.71-Privilege-Escalation.htmlExploit, Patch, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/Apr/42Exploit, Mailing List, Patch, Third Party Advisory
• https://cert.vde.com/en/advisories/VDE-2022-015/Mitigation, Third Party Advisory
• https://www.miele.de/p/miele-benchmark-programming-tool-2296.htmPatch, Product, Release Notes, Vendor Advisory
• http://packetstormsecurity.com/files/166881/Miele-Benchmark-Programming-Tool-1.1.49-1.2.71-Privilege-Escalation.htmlExploit, Patch, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/Apr/42Exploit, Mailing List, Patch, Third Party Advisory
• https://cert.vde.com/en/advisories/VDE-2022-015/Mitigation, Third Party Advisory
• https://www.miele.de/p/miele-benchmark-programming-tool-2296.htmPatch, Product, Release Notes, Vendor Advisory

Published

Apr 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-22516The SysDrv3S driver in the CODESYS Control runtime system on…7.8
• CVE-2022-22517An unauthenticated, remote attacker can disrupt existing com…7.5
• CVE-2022-22518A bug in CmpUserMgr component can lead to only partially app…6.5
• CVE-2022-22519A remote, unauthenticated attacker can send a specific craft…7.5
• CVE-2022-2252Open Redirect in GitHub repository microweber/microweber pri…6.1
• CVE-2022-22520A remote, unauthenticated attacker can enumerate valid users…5.3
• CVE-2022-22522In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Par…9.8
• CVE-2022-22523An improper authentication vulnerability exists in the Carlo…7.5
• CVE-2022-22524In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Par…9.4
• CVE-2022-22525In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Par…7.2
• CVE-2022-22526In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Par…9.8
• CVE-2022-22528SAP Adaptive Server Enterprise (ASE) - version 16.0, install…7.8