CVE-2022-32509

Executive Summary

CVE-2022-32509 is a critical security vulnerability affecting Nuki Home Solutions devices, specifically the Nuki Smart Lock 3.0 (before 3.3.5), Nuki Bridge v1 (before 1.22.0), and Nuki Bridge v2 (before 2.13.2). The vulnerability stems from a lack of certificate validation on HTTP communications, allowing attackers to intercept and tamper with data in transit. This flaw enables man-in-the-middle (MITM) attacks, potentially compromising the integrity and confidentiality of communications between the Nuki devices and their associated mobile apps or cloud services. The CVSS score is 0.0 due to incomplete scoring data, but the impact is severe, with a CVSS vector suggesting high confidentiality, integrity, and availability impacts. No public exploit code or proof-of-concept is available, and the patch status remains unknown, leaving affected devices vulnerable.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects proprietary hardware and firmware from Nuki Home Solutions, a smart lock and bridge manufacturer. The supply chain risk is limited to the physical devices and their firmware updates, which are distributed through the vendor's official channels.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Incomplete scoring; likely high based on vector)
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions are required for exploitation.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The impact is confined to the affected component.
• Confidentiality Impact: High (C:H) – Attackers can intercept sensitive data.
• Integrity Impact: High (I:H) – Attackers can tamper with data.
• Availability Impact: High (A:H) – Attackers could disrupt communications.
• Threat Level: Critical – The lack of certificate validation allows MITM attacks, which can lead to full compromise of device communications.

Deep Dive & Mechanics

The vulnerability lies in the HTTP communication stack of Nuki devices. The devices fail to validate SSL/TLS certificates when establishing HTTPS connections. This means that an attacker positioned on the network (e.g., on the same Wi-Fi network or via a compromised router) can perform a man-in-the-middle attack by presenting a self-signed or forged certificate. The device will accept this certificate without verification, allowing the attacker to decrypt, read, and modify all traffic between the device and its backend services.

The affected components include:

• Nuki Smart Lock 3.0: Firmware versions before 3.3.5.
• Nuki Bridge v1: Firmware versions before 1.22.0.
• Nuki Bridge v2: Firmware versions before 2.13.2.

The lack of certificate validation is a classic CWE-295 (Improper Certificate Validation) issue. This can lead to:

• Interception of authentication tokens and credentials.
• Tampering with lock commands (e.g., unlocking/locking doors).
• Injection of malicious firmware updates.
• Data exfiltration of user information.

Vulnerable vs. Patched Code

No official patch code is available. However, the fix would involve implementing proper certificate validation in the HTTP client used by the firmware. Below is a conceptual comparison:

Vulnerable Code (Conceptual)

import requests

# Vulnerable: No certificate verification
response = requests.get('https://api.nuki.io/endpoint', verify=False)

Patched Code (Conceptual)

import requests

# Patched: Certificate verification enabled
response = requests.get('https://api.nuki.io/endpoint', verify=True)

In the vulnerable version, the verify=False parameter disables SSL certificate checking. The patched version uses verify=True (or omits the parameter) to enforce certificate validation.

Exploitation & Lab Setup

Red Team (Exploitation)

To exploit this vulnerability, an attacker needs to be on the same network as the Nuki device or have control over a network path. The following steps outline a basic MITM attack:

1. Set up a rogue access point or ARP spoof to intercept traffic.
2. Use a tool like mitmproxy or Bettercap to intercept HTTPS traffic.
3. Generate a self-signed certificate for the target domain (e.g., api.nuki.io).
4. Configure the MITM tool to present the fake certificate to the Nuki device.
5. Capture and modify traffic as needed.

Example using mitmproxy:

# Start mitmproxy with transparent proxy mode
mitmproxy --mode transparent --listen-port 8080

Then, redirect traffic to the proxy using ARP spoofing:

arpspoof -i eth0 -t 192.168.1.100 192.168.1.1

Blue Team (Defense)

To detect and defend against this attack:

• Monitor for unusual SSL/TLS certificates on the network using tools like Zeek or Suricata.
• Implement network segmentation to isolate IoT devices.
• Use a VPN for all device communications.
• Regularly update firmware to the latest patched version (if available).
• Deploy an IDS/IPS to detect MITM attacks.

Indicators of Compromise (IOCs)

• Network Traffic: HTTPS connections to Nuki domains using self-signed or untrusted certificates.
• Device Behavior: Unexpected lock/unlock commands or firmware update requests.
• Logs: Repeated SSL/TLS handshake failures or certificate warnings in device logs.
• IP Addresses: Unknown IPs acting as MITM proxies (e.g., common proxy ports like 8080, 3128).
• File Hashes: Modified firmware images with different SHA-256 hashes.

Detection Engineering

YARA Rule

rule CVE_2022_32509_Nuki_Cert_Validation {
    meta:
        description = "Detects Nuki firmware with disabled certificate validation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-32509"
    strings:
        $s1 = "verify=False" ascii wide nocase
        $s2 = "CERTIFICATE_VERIFY_FAILED" ascii wide nocase
        $s3 = "ssl._create_default_https_context" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: Nuki CVE-2022-32509 Certificate Validation Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects network traffic indicating lack of certificate validation on Nuki devices
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        - ssl.certificate_issuer: "CN=*"  # Self-signed or untrusted
        - ssl.validation_status: "self-signed"
    condition: selection
falsepositives:
    - Legitimate self-signed certificates in test environments
level: high

Suricata Rule

alert tls $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2022-32509 Nuki Certificate Validation Bypass"; flow:to_server; tls.cert_issuer:!".*nuki.*"; tls.cert_subject:!".*nuki.*"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Update Firmware: Apply the latest firmware updates from Nuki Home Solutions for Smart Lock 3.0 (>=3.3.5), Bridge v1 (>=1.22.0), and Bridge v2 (>=2.13.2).
2. Network Segmentation: Place Nuki devices on a separate VLAN with strict firewall rules.
3. Certificate Pinning: Implement certificate pinning in the mobile app and device firmware.
4. Monitor Traffic: Use IDS/IPS to detect MITM attacks.
5. Disable Unused Features: If possible, disable HTTP fallback and enforce HTTPS only.
6. Vendor Notification: Contact Nuki support for patch availability if not yet updated.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert