CVE-2022-32510

An issue was discovered on certain Nuki Home Solutions devices. The HTTP API exposed by a Bridge used an unencrypted channel to provide an administrative interface. A token can be easily eavesdropped by a malicious actor to impersonate a legitimate user and gain access to the full set of API endpoints. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.

• CWE-319

• https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/
• https://nuki.io/en/security-updates/
• https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/
• https://www.hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options/
• https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/
• https://nuki.io/en/security-updates/
• https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/
• https://www.hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options/

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-32505An issue was discovered on certain Nuki Home Solutions devic…7.1
• CVE-2022-32506An issue was discovered on certain Nuki Home Solutions devic…6.4
• CVE-2022-32507An issue was discovered on certain Nuki Home Solutions devic…8.8
• CVE-2022-32508An issue was discovered on certain Nuki Home Solutions devic…7.5
• CVE-2022-32509An issue was discovered on certain Nuki Home Solutions devic…8.8
• CVE-2022-3251Sensitive Cookie in HTTPS Session Without 'Secure' Attribute…5.3
• CVE-2022-32511jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.l…9.8
• CVE-2022-32512A CWE-119: Improper Restriction of Operations within the Bou…7.8
• CVE-2022-32513A CWE-521: Weak Password Requirements vulnerability exists t…9.8
• CVE-2022-32514A CWE-287: Improper Authentication vulnerability exists that…9.8
• CVE-2022-32515A CWE-307: Improper Restriction of Excessive Authentication …9.8
• CVE-2022-32516A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability e…6.5