CVE-2022-32507
📋 TL;DR
This vulnerability allows unprivileged users to execute Bluetooth Low Energy (BLE) commands that should require privileged access on Nuki smart locks. It affects Nuki Smart Lock 3.0 before version 3.3.5 and Nuki Smart Lock 2.0 before version 2.12.4, enabling unauthorized control of the locks.
💻 Affected Systems
- Nuki Smart Lock 3.0
- Nuki Smart Lock 2.0
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers within BLE range could unlock doors, change lock settings, or disable security features without authorization, potentially leading to physical security breaches.
Likely Case
Unauthorized users with BLE access could unlock doors or manipulate lock settings, compromising home or building security.
If Mitigated
With proper access controls, only authorized users could execute privileged BLE commands, maintaining intended security functionality.
🎯 Exploit Status
Technical details and proof-of-concept are publicly available in research publications. Exploitation requires BLE-capable device and proximity to the lock.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Nuki Smart Lock 3.0: 3.3.5 or later; Nuki Smart Lock 2.0: 2.12.4 or later
Vendor Advisory: https://nuki.io/en/security-updates/
Restart Required: Yes
Instructions:
1. Open Nuki app on your smartphone. 2. Navigate to your lock's settings. 3. Check for firmware updates. 4. If update available, install it. 5. The lock will restart automatically after update.
🔧 Temporary Workarounds
Disable Bluetooth when not in use
allTemporarily disable Bluetooth functionality on the lock to prevent BLE attacks (limits remote access functionality)
Increase physical security monitoring
allEnhance surveillance and physical access controls around vulnerable locks
🧯 If You Can't Patch
- Physically secure the lock location to prevent unauthorized BLE proximity
- Implement additional physical security measures (cameras, alarms, secondary locks)
🔍 How to Verify
Check if Vulnerable:
Check firmware version in Nuki app: Settings > Your Lock > Firmware VersionCheck Version:
Nuki app: Settings > Your Lock > Firmware VersionVerify Fix Applied:
Confirm firmware version is 3.3.5 or later for Smart Lock 3.0, or 2.12.4 or later for Smart Lock 2.0📡 Detection & Monitoring
Log Indicators:
- Multiple failed BLE authentication attempts
- Unusual BLE command patterns from unknown devices
Network Indicators:
- Unusual BLE traffic patterns near lock locations
- BLE connections from unauthorized devices
SIEM Query:
Not applicable - physical BLE attacks don't generate traditional network logs🔗 References
- https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/
- https://nuki.io/en/security-updates/
- https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/
- https://www.hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options/
- https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/
- https://nuki.io/en/security-updates/
- https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/
- https://www.hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options/
