CVE-2022-32510

Impact

An issue was discovered on certain Nuki Home Solutions devices. The HTTP API exposed by a Bridge used an unencrypted channel to provide an administrative interface. A token can be easily eavesdropped by a malicious actor to impersonate a legitimate user and gain access to the full set of API endpoints. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.

Affected products

Versions were read from the advisory text. No structured product data has been published for this record yet.

Weakness classification

References

• NVD record
• CVE.org record
• https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/
• https://nuki.io/en/security-updates/
• https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/
• https://www.hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options/
• https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/
• https://nuki.io/en/security-updates/
• https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/
• https://www.hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options/