CVE-2022-32510

An issue was discovered on certain Nuki Home Solutions devices

High · published May 9, 2024

CVSS v3.1
7.1
EPSS
0%
Percentile
21.6
In the wild
Unconfirmed
What it is

An issue was discovered on certain Nuki Home Solutions devices. The HTTP API exposed by a Bridge used an unencrypted channel to provide an administrative interface. A token can be easily eavesdropped by a malicious actor to impersonate a legitimate user and gain access to the full set of API endpoints. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00300 · 21.6th percentile
Published
2024-05-09T19:44Z
EPSS history
Timeline
  • 09 MAY 19:44Z
    An issue was discovered on certain Nuki Home Solutions devices
    cvelistv5