Critical · published May 9, 2024
🚨 A stack buffer overflow in Nuki devices could turn your smart lock into a hacker's playground! 🔥 Think of it like a sneaky intruder sneaking into a home through an unguarded window—once they're in, they can control everything inside. In this case, the WebSocket service serves as that vulnerable window, allowing attackers to execute their code without breaking a sweat. An attacker exploiting this vulnerability could gain complete control over the KeyTurner device, potentially unlocking doors and granting access to your home! This could lead to unauthorized entry, putting your safety at risk and causing chaos in your smart home setup.
Think of it like a sneaky intruder sneaking into a home through an unguarded window—once they're in, they can control everything inside. In this case, the WebSocket service serves as that vulnerable window, allowing attackers to execute their code without breaking a sweat. This vulnerability arises from improper parsing of JSON objects by the Nuki devices, leading to a stack buffer overflow, which enables arbitrary code execution on the affected devices. This affects Nuki Smart Lock 3.0 prior to version 3.3.5, Smart Lock 2.0 prior to 2.12.4, and Nuki Bridge v1 and v2 before versions 1.22.0 and 2.13.2 respectively.
An attacker exploiting this vulnerability could gain complete control over the KeyTurner device, potentially unlocking doors and granting access to your home! This could lead to unauthorized entry, putting your safety at risk and causing chaos in your smart home setup. To secure your devices, immediately update your Nuki Smart Lock and Bridge to the latest versions—3.3.5 for Smart Lock 3.0, 2.12.4 for Smart Lock 2.0, and 1.22.0 and 2.13.2 for Nuki Bridge. Regularly check for firmware updates to keep your devices safe from future vulnerabilities! You've got this! Just a few updates and you'll ensure your smart home remains a secure fortress! 🛡️