CVE-2022-32508

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered on certain Nuki Home Solutions devices. By sending a malformed HTTP verb, it is possible to force a reboot of the device. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

VendorProductVersions
n/an/an/a
nukibridge_v1< 1.22.0
nukibridge_v2< 2.13.2

References

Timeline

Published
May 14, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2022

CVE-2022-325098.8An issue was discovered on certain Nuki Home Solutions devices. Lack of certificate validation on HTTP communications allows attackers to inCVE-2022-32515.3Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/minarca prior to 4.2.2.CVE-2022-325107.1An issue was discovered on certain Nuki Home Solutions devices. The HTTP API exposed by a Bridge used an unencrypted channel to provide an aCVE-2022-325119.8jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.CVE-2022-325127.8A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause remote code executiCVE-2022-325139.8A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brutCVE-2022-325149.8A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web pCVE-2022-325159.8A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over CVE-2022-325166.5A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could cause system’s configurations override and cause a reboot loop CVE-2022-325176.5A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause an adversary to trick the interface uCVE-2022-325189.8A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed oCVE-2022-325199.8A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when perfor
CVE-2022-32508: High severity, CVSS 7.5 | Vulnix