Nuki vulnerabilities
We track 6 vulnerabilities in Nuki products across 7 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on May 14, 2024.
Latest Nuki vulnerabilities
- 8.8 High severity
smart_lock_v3_pro: Improper Certificate Validation
An issue was discovered on certain Nuki Home Solutions devices. Lack of certificate validation on HTTP communications allows attackers to intercept and tamper data. This affects Nuki Smart Lock 3.0 before 3.3.5, Nuki Bridge v1 before 1.22.0 and Nuki Bridge v2
- 7.5 High severity
bridge_v1: Uncontrolled Resource Consumption
An issue was discovered on certain Nuki Home Solutions devices. By sending a malformed HTTP verb, it is possible to force a reboot of the device. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.
- 8.8 High severity
smart_lock_v3_pro: Improper Access Control
An issue was discovered on certain Nuki Home Solutions devices. Some BLE commands, which should have been designed to be only called from privileged accounts, could also be called from unprivileged accounts. This demonstrates that no access controls were imple
- 7.1 High severity
smart_lock_v3_pro: Uncontrolled Resource Consumption
An issue was discovered on certain Nuki Home Solutions devices. It is possible to send multiple BLE malformed packets to block some of the functionality and reboot the device. This affects Nuki Smart Lock 3.0 before 3.3.5 and Nuki Smart Lock 2.0 before 2.12.4.
- 9.8 Critical severity
nuki_smart_lock: Buffer Copy without Checking Size of Input
An issue was discovered on certain Nuki Home Solutions devices. The code used to parse the JSON objects received from the WebSocket service provided by the device leads to a stack buffer overflow. An attacker would be able to exploit this to gain arbitrary cod
- 7.6 High severity
keypad: Missing Authentication for Critical Functionality
An issue was discovered on certain Nuki Home Solutions devices. An attacker with physical access to this JTAG port may be able to connect to the device and bypass both hardware and software security protections. This affects Nuki Keypad before 1.9.2 and Nuki F