« Volver al listado

CVE-2022-32504

Estado: AplazadaCrítica (9.8)—

An issue was discovered on certain Nuki Home Solutions devices. The code used to parse the JSON objects received from the WebSocket service provided by the device leads to a stack buffer overflow. An attacker would be able to exploit this to gain arbitrary code execution on a KeyTurner device. This affects Nuki Smart Lock 3.0 before 3.3.5 and 2.0 before 2.12.4, as well as Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Nuki — Bridge V1AINuki — Bridge V2AINuki — Smart Lock 2.0AINuki — Smart Lock 3.0AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-32504",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-32504",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-15T15:36:12.306527Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:nuki:nuki_smart_lock:3.0:*:*:*:*:*:*:*"
          ],
          "vendor": "nuki",
          "product": "nuki_smart_lock",
          "versions": [
            {
              "status": "affected",
              "version": "3.0*",
              "lessThan": "3.3.5",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:nuki:nuki_smart_lock:2.0:*:*:*:*:*:*:*"
          ],
          "vendor": "nuki",
          "product": "nuki_smart_lock",
          "versions": [
            {
              "status": "affected",
              "version": "2.0*",
              "lessThan": "2.12.4",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:nuki:bridge_v1:*:*:*:*:*:*:*:*"
          ],
          "vendor": "nuki",
          "product": "bridge_v1",
          "versions": [
            {
              "status": "affected",
              "version": "1.22.0*",
              "lessThan": "1.22.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:nuki:bridge_v1:*:*:*:*:*:*:*:*"
          ],
          "vendor": "nuki",
          "product": "bridge_v1",
          "versions": [
            {
              "status": "affected",
              "version": "2.13.2*",
              "lessThan": "2.13.2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-14T10:43:41.203",
  "references": [
    {
      "url": "https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://nuki.io/en/security-updates/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://nuki.io/en/security-updates/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered on certain Nuki Home Solutions devices. The code used to parse the JSON objects received from the WebSocket service provided by the device leads to a stack buffer overflow. An attacker would be able to exploit this to gain arbitrary code execution on a KeyTurner device. This affects Nuki Smart Lock 3.0 before 3.3.5 and 2.0 before 2.12.4, as well as Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2."
    },
    {
      "lang": "es",
      "value": "Se ha descubierto un problema en determinados dispositivos de Nuki Home Solutions. El código utilizado para analizar los objetos JSON recibidos del servicio WebSocket proporcionado por el dispositivo provoca un desbordamiento del búfer de pila. Un atacante podría aprovechar esto para obtener la ejecución de código arbitrario en un dispositivo KeyTurner. Esto afecta a Nuki Smart Lock 3.0 anterior a 3.3.5 y 2.0 anterior a 2.12.4, así como a Nuki Bridge v1 anterior a 1.22.0 y v2 anterior a 2.13.2."
    }
  ],
  "lastModified": "2026-06-17T04:47:25.807",
  "sourceIdentifier": "cve@mitre.org"
}