CVE-2022-32503

Executive Summary

CVE-2022-32503 identifies a critical physical security vulnerability in Nuki Home Solutions devices, specifically the Nuki Keypad (versions prior to 1.9.2) and Nuki Fob (versions prior to 1.8.1). An attacker with physical access to the JTAG (Joint Test Action Group) port can bypass both hardware and software security protections, potentially gaining full control over the device. This vulnerability is particularly concerning for smart lock systems, as it could allow an attacker to unlock doors, disable alarms, or extract cryptographic keys. The vulnerability has a CVSS score of 0.0 due to the requirement for physical access, but the impact on physical security is severe. No public proof-of-concept (PoC) or exploit code is available, and no official patch has been released; mitigation relies on physical security measures.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD assigned, likely due to physical access requirement)
• Attack Vector (AV): Physical (requires physical access to the device)
• Attack Complexity (AC): Low (JTAG is a standard interface)
• Privileges Required (PR): None
• User Interaction (UI): None
• Scope (S): Changed (compromise of device can affect other systems)
• Confidentiality (C): High (potential to extract keys and data)
• Integrity (I): High (ability to modify firmware)
• Availability (A): High (device can be bricked or disabled)
• Threat Level: High (due to physical security implications, despite low CVSS)

Deep Dive & Mechanics

The vulnerability lies in the exposed JTAG port on Nuki Keypad and Nuki Fob devices. JTAG is a standard interface used for debugging, programming, and testing integrated circuits. In these devices, the JTAG port is accessible without requiring disassembly or specialized tools, allowing an attacker to:

1. Connect to the JTAG port using a standard JTAG adapter (e.g., Bus Pirate, J-Link).
2. Bypass hardware security by reading or writing to the device's memory directly.
3. Bypass software security by modifying firmware, disabling authentication, or extracting cryptographic keys.
4. Gain full control over the device, potentially allowing unauthorized door unlocking or disabling of security features.

The root cause is the lack of JTAG lock-down or physical access controls. Many embedded devices disable JTAG after production, but Nuki did not implement this protection. The vulnerability affects the Nuki Keypad (used for PIN-based door unlocking) and Nuki Fob (used for keyless entry). An attacker could use this to clone credentials, disable the device, or use it as a pivot point to attack the broader smart home network.

Vulnerable vs. Patched Code

No code-level patch is available. The vulnerability is a hardware design flaw. The "patched" versions (Keypad 1.9.2, Fob 1.8.1) are not confirmed to have JTAG disabled; the advisory only states the issue was "discovered" on certain devices. The vendor has not released a firmware update to disable JTAG. The only mitigation is physical security (e.g., tamper-proof enclosures, disabling JTAG via hardware modification).

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Physical access to a vulnerable Nuki Keypad or Fob.
• JTAG adapter (e.g., Segger J-Link, Bus Pirate, or OpenOCD-compatible adapter).
• Software: OpenOCD, GDB, or vendor-specific tools.

Steps:

1. Identify JTAG pins: Use a multimeter or logic analyzer to locate the JTAG interface (TMS, TCK, TDI, TDO, VCC, GND) on the device PCB.
2. Connect JTAG adapter: Wire the adapter to the identified pins.
3. Scan JTAG chain: Use OpenOCD to detect the device:

   openocd -f interface/jlink.cfg -f target/your_target.cfg -c "init; scan_chain; exit"
   

4. Dump firmware: Read the device memory to extract firmware and keys:

   openocd -f interface/jlink.cfg -f target/your_target.cfg -c "init; halt; flash read_bank 0 firmware.bin; exit"
   

5. Modify firmware: Disable authentication checks or inject backdoor code, then write back:

   openocd -f interface/jlink.cfg -f target/your_target.cfg -c "init; halt; flash write_bank 0 modified_firmware.bin; exit"
   

6. Bypass security: Use extracted keys to clone the device or unlock doors without authorization.

No public exploit code is available.

Blue Team (Defense & Detection)

Mitigation Steps:

1. Physical security: Install devices in tamper-proof enclosures with tamper switches that trigger alarms.
2. JTAG disable: If possible, physically disable the JTAG port by cutting traces or applying epoxy.
3. Firmware hardening: Request vendor to release a firmware update that disables JTAG after boot.
4. Monitoring: Monitor for physical tampering (e.g., vibration sensors, door open/close logs).
5. Network segmentation: Isolate smart lock devices on a separate VLAN to limit lateral movement.

Detection:

• Physical: Tamper switches, security cameras, intrusion detection systems.
• Network: Unusual traffic from the device (e.g., unexpected SSH/Telnet connections, firmware download attempts).
• Logs: Monitor device logs for JTAG connection attempts (if supported).

Indicators of Compromise (IOCs)

• Physical: Exposed JTAG pins on Nuki Keypad/Fob PCB.
• Network: Unusual TCP/UDP connections from the device to unknown IPs (e.g., port 4444 for OpenOCD).
• Firmware: Modified firmware hash (compare with known good hash from vendor).
• Behavior: Device unlocking without valid PIN/Fob, repeated failed authentication attempts.

Detection Engineering

YARA Rule

rule CVE_2022_32503_Nuki_JTAG_Exploit {
    meta:
        description = "Detects firmware dumps or modified firmware from Nuki devices"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-32503"
    strings:
        $firmware_header = "NUKI" ascii wide nocase
        $jtag_string = "JTAG" ascii wide nocase
        $debug_string = "OpenOCD" ascii wide nocase
    condition:
        any of ($firmware_header) and ($jtag_string or $debug_string)
}

Sigma Rule

title: Nuki JTAG Exploitation Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects network traffic associated with JTAG exploitation of Nuki devices
author: Valters IT
date: 2025/04/10
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort:
            - 4444  # OpenOCD default
            - 2331  # J-Link default
        Image|endswith:
            - '\openocd.exe'
            - '\jlink.exe'
    condition: selection
falsepositives:
    - Legitimate debugging by authorized personnel
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"CVE-2022-32503 Nuki JTAG Exploitation - OpenOCD Connection"; flow:to_server; content:"OpenOCD"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Physically secure Nuki devices to prevent unauthorized access. Use tamper-proof enclosures and disable JTAG if possible.
2. Short-term: Contact Nuki support for guidance. Monitor for firmware updates that disable JTAG.
3. Long-term: Replace vulnerable devices with models that have JTAG disabled by default or use secure boot.
4. Compensating controls: Implement network segmentation, intrusion detection, and physical security monitoring.

No official patch is available. The vendor has not released a firmware update to address this issue.

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.