CVE-2022-32502

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

An issue was discovered on certain Nuki Home Solutions devices. There is a buffer overflow over the encrypted token parsing logic in the HTTP service that allows remote code execution. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-121

Affected software

No affected versions have been published.

Timeline

Published
May 14, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2022

CVE-2022-325037.6An issue was discovered on certain Nuki Home Solutions devices. An attacker with physical access to this JTAG port may be able to connect toCVE-2022-325049.8An issue was discovered on certain Nuki Home Solutions devices. The code used to parse the JSON objects received from the WebSocket service CVE-2022-325057.1An issue was discovered on certain Nuki Home Solutions devices. It is possible to send multiple BLE malformed packets to block some of the fCVE-2022-325066.4An issue was discovered on certain Nuki Home Solutions devices. An attacker with physical access to the circuit board could use the SWD debuCVE-2022-325078.8An issue was discovered on certain Nuki Home Solutions devices. Some BLE commands, which should have been designed to be only called from prCVE-2022-325087.5An issue was discovered on certain Nuki Home Solutions devices. By sending a malformed HTTP verb, it is possible to force a reboot of the deCVE-2022-325098.8An issue was discovered on certain Nuki Home Solutions devices. Lack of certificate validation on HTTP communications allows attackers to inCVE-2022-32515.3Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/minarca prior to 4.2.2.CVE-2022-325107.1An issue was discovered on certain Nuki Home Solutions devices. The HTTP API exposed by a Bridge used an unencrypted channel to provide an aCVE-2022-325119.8jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.CVE-2022-325127.8A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause remote code executiCVE-2022-325139.8A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brut
CVE-2022-32502: Medium severity, CVSS 6.3 | Vulnix