PT-2024-11566 · Nuki Home Solutions · Nuki Bridge

Name of the Vulnerable Software and Affected Versions: Nuki Bridge versions prior to 1.22.0 Nuki Bridge versions prior to 2.13.2 Description: A buffer overflow issue was discovered in the HTTP service of certain Nuki Home Solutions devices, specifically in the encrypted token parsing logic. This...

PT-2024-11572 · Nuki Home Solutions · Nuki Bridge

Name of the Vulnerable Software and Affected Versions: Nuki Bridge versions prior to 1.22.0 Nuki Bridge versions prior to 2.13.2 Description: An issue was discovered on certain Nuki Home Solutions devices, where sending a malformed HTTP verb can force a reboot of the device. Recommendations: For...

PT-2024-11569 · Nuki · Nuki Smart Lock 2.0 +1

Name of the Vulnerable Software and Affected Versions: Nuki Smart Lock 3.0 versions 3.0 through 3.3.4 Nuki Smart Lock 2.0 versions 2.0 through 2.12.3 Description: An issue was discovered on certain Nuki Home Solutions devices, where it is possible to send multiple BLE malformed packets to block...

PT-2024-11570 · Nuki · Nuki Smart Lock 2.0 +3

Name of the Vulnerable Software and Affected Versions: Nuki Smart Lock 3.0 versions 3.0 through 3.3.4 Nuki Smart Lock 2.0 versions 2.0 through 2.12.3 Nuki Bridge v1 versions 1.0 through 1.21.9 Nuki Bridge v2 versions 2.0 through 2.13.1 Description: An issue was discovered on certain Nuki Home...

PT-2024-11567 · Nuki · Nuki Keypad +1

Name of the Vulnerable Software and Affected Versions: Nuki Keypad versions prior to 1.9.2 Nuki Fob versions prior to 1.8.1 Description: An issue was discovered on certain Nuki Home Solutions devices, where an attacker with physical access to the JTAG port may be able to connect to the device and...

PT-2024-11568 · Nuki · Keyturner +2

Name of the Vulnerable Software and Affected Versions: Nuki Smart Lock versions 3.0 through 3.3.4 Nuki Smart Lock versions 2.0 through 2.12.3 Nuki Bridge versions 1.0 through 1.21.9 Nuki Bridge versions 2.0 through 2.13.1 Description: An issue was discovered in certain Nuki Home Solutions devices...

Critical Vulnerabilities Exposed Nuki Smart Locks to a Plethora of Attack Options

By Deeba Ahmed Researchers have identified as many as eleven critical vulnerabilities in different versions of Nuki Smart Locks. The IT… This is a post from HackRead.com Read the original post: Critical Vulnerabilities Exposed Nuki Smart Locks to a Plethora of Attack Options...

CVE-2022-32507

An issue was discovered on certain Nuki Home Solutions devices. Some BLE commands, which should have been designed to be only called from privileged accounts, could also be called from unprivileged accounts. This demonstrates that no access controls were implemented for the different BLE commands...

CVE-2022-32509

An issue was discovered on certain Nuki Home Solutions devices. Lack of certificate validation on HTTP communications allows attackers to intercept and tamper data. This affects Nuki Smart Lock 3.0 before 3.3.5, Nuki Bridge v1 before 1.22.0 and Nuki Bridge v2 before 2.13.2...

CVE-2022-32503

An issue was discovered on certain Nuki Home Solutions devices. An attacker with physical access to this JTAG port may be able to connect to the device and bypass both hardware and software security protections. This affects Nuki Keypad before 1.9.2 and Nuki Fob before 1.8.1...

CVE-2022-32510

An issue was discovered on certain Nuki Home Solutions devices. The HTTP API exposed by a Bridge used an unencrypted channel to provide an administrative interface. A token can be easily eavesdropped by a malicious actor to impersonate a legitimate user and gain access to the full set of API...

CVE-2022-32504

An issue was discovered on certain Nuki Home Solutions devices. The code used to parse the JSON objects received from the WebSocket service provided by the device leads to a stack buffer overflow. An attacker would be able to exploit this to gain arbitrary code execution on a KeyTurner device. Th...