by Kastro
Paper/Archive/CVE-2022-32504

CVE-2022-32504

nuki nuki_smart_lock — An issue was discovered on certain Nuki Home Solutions devices.

EPSS 2%public exploitCVSS 9.8
critical.is priorityof 100
55
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 75.9.759 × 2015.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An issue was discovered on certain Nuki Home Solutions devices. The code used to parse the JSON objects received from the WebSocket service provided by the device leads to a stack buffer overflow. An attacker would be able to exploit this to gain arbitrary code execution on a KeyTurner device. This affects Nuki Smart Lock 3.0 before 3.3.5 and 2.0 before 2.12.4, as well as Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
nuki_smart_lock3.0* – < 3.3.53.3.5CISA-ADP
nuki_smart_lock2.0* – < 2.12.42.12.4CISA-ADP
bridge_v11.22.0* – < 1.22.01.22.0CISA-ADP
bridge_v12.13.2* – < 2.13.22.13.2CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refresearch.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2refhackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-optionsreflatesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locksrefnuki.io/en/security-updates