PT-2024-11570 · Nuki · Nuki Smart Lock 3.0+3

Published 2024-05-09 · Updated 2024-08-20 · CVE-2022-32506

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nuki Smart Lock 3.0 versions 3.0 through 3.3.4 Nuki Smart Lock 2.0 versions 2.0 through 2.12.3 Nuki Bridge v1 versions 1.0 through 1.21.9 Nuki Bridge v2 versions 2.0 through 2.13.1

Description An issue was discovered on certain Nuki Home Solutions devices. An attacker with physical access to the circuit board could use the SWD debug features to control the execution of code on the processor and debug the firmware, as well as read or alter the content of the internal and external flash memory.

Recommendations For Nuki Smart Lock 3.0 versions 3.0 through 3.3.4, update to version 3.3.5 or later. For Nuki Smart Lock 2.0 versions 2.0 through 2.12.3, update to version 2.12.4 or later. For Nuki Bridge v1 versions 1.0 through 1.21.9, update to version 1.22.0 or later. For Nuki Bridge v2 versions 2.0 through 2.13.1, update to version 2.13.2 or later.

Fix

Weakness Enumeration

CWE-1263

Related Identifiers

CVE-2022-32506

Affected Products

Nuki Bridge V1

Nuki Bridge V2

Nuki Smart Lock 2.0

Nuki Smart Lock 3.0

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-32506 · Security Note
• https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2 · Note
• https://hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options · Note
• https://nuki.io/en/security-updates · Note
• https://t.me/cvenotify/91276 · Telegram Post
• https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks · Note