CVE-2022-32504

An issue was discovered on certain Nuki Home Solutions devices. The code used to parse the JSON objects received from the WebSocket service provided by the device leads to a stack buffer overflow. An attacker would be able to exploit this to gain arbitrary code execution on a KeyTurner device. This affects Nuki Smart Lock 3.0 before 3.3.5 and 2.0 before 2.12.4, as well as Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.

• CWE-120

• https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/
• https://nuki.io/en/security-updates/
• https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/
• https://www.hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options/
• https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/
• https://nuki.io/en/security-updates/
• https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/
• https://www.hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options/

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-32496Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-32497Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-32498Dell EMC PowerStore, Versions prior to v3.0.0.0 contain a DL…7.8
• CVE-2022-3250Sensitive Cookie in HTTPS Session Without 'Secure' Attribute…5.3
• CVE-2022-32502An issue was discovered on certain Nuki Home Solutions devic…6.3
• CVE-2022-32503An issue was discovered on certain Nuki Home Solutions devic…7.6
• CVE-2022-32505An issue was discovered on certain Nuki Home Solutions devic…7.1
• CVE-2022-32506An issue was discovered on certain Nuki Home Solutions devic…6.4
• CVE-2022-32507An issue was discovered on certain Nuki Home Solutions devic…8.8
• CVE-2022-32508An issue was discovered on certain Nuki Home Solutions devic…7.5
• CVE-2022-32509An issue was discovered on certain Nuki Home Solutions devic…8.8
• CVE-2022-3251Sensitive Cookie in HTTPS Session Without 'Secure' Attribute…5.3