CVE-2022-32506 Security feature bypass in n/a
Attackers with physical access can use SWD debug features to execute code and read or modify firmware on Nuki Smart Locks and Bridges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-32506?
CVE-2022-32506 is a medium-severity vulnerability in n/a, published on 9 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered on certain Nuki Home Solutions devices. An attacker with physical access to the circuit board could use the SWD debug features to control the execution of code on the processor and debug the firmware, as well as read or alter the content of the internal and external flash memory. This affects Nuki Smart Lock 3.0 before 3.3.5, Nuki Smart Lock 2.0 before 2.12.4, as well as Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.
Weakness: CWE-1263
Which versions are affected by CVE-2022-32506?
How do I fix CVE-2022-32506?
No fix has been published for CVE-2022-32506 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-32506 being exploited?
There is no known exploitation of CVE-2022-32506 in the wild and no public exploit code.
Sources
Also known as GHSA-h34r-96vv-vxhc.