CVE-2022-32510

Executive Summary

CVE-2022-32510 exposes a critical security flaw in Nuki Home Solutions Bridge devices. The vulnerability stems from the HTTP API being served over an unencrypted channel, allowing an attacker on the same network to eavesdrop on authentication tokens. With a captured token, an attacker can impersonate a legitimate user and gain full administrative access to the Bridge's API endpoints, potentially unlocking doors, changing settings, or exfiltrating sensitive data. The CVSS score is 0.0 due to incomplete NVD data, but the actual risk is high given the potential for physical security compromise. No public proof-of-concept or exploit code is available at this time.

CVSS Breakdown & Threat Level

While the NVD assigned a score of 0.0, a realistic assessment based on the vulnerability description yields the following:

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs network access.
• Privileges Required (PR): None (N) – No authentication is needed to initiate the eavesdropping.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The compromised component is the Bridge itself.
• Confidentiality (C): High (H) – Tokens and potentially sensitive data are exposed.
• Integrity (I): High (H) – An attacker can modify Bridge settings or control locks.
• Availability (A): High (H) – An attacker could disrupt normal operation.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score: 9.8 (Critical)

Deep Dive & Mechanics

The Nuki Bridge acts as a central hub connecting Nuki smart locks to the internet and local network. It exposes an HTTP API for administrative tasks, such as locking/unlocking doors, managing user permissions, and viewing logs. The vulnerability lies in the fact that this API is served over plain HTTP (port 80) rather than HTTPS (port 443). This means all communication, including authentication tokens, is transmitted in cleartext.

An attacker on the same local network (e.g., via Wi-Fi or Ethernet) can perform a man-in-the-middle (MITM) attack or simply sniff network traffic using tools like Wireshark or tcpdump. Once a legitimate user authenticates to the Bridge (e.g., via the Nuki app or web interface), the attacker captures the token from the HTTP request. This token is then reused to make API calls as the authenticated user, bypassing any further authentication.

The affected firmware versions are:

• Nuki Bridge v1: before 1.22.0
• Nuki Bridge v2: before 2.13.2

The fix involves enforcing HTTPS for all API communications, ensuring tokens are encrypted in transit.

Vulnerable vs. Patched Code

The vulnerability is not in the application logic but in the network configuration. The vulnerable code path is the HTTP listener that accepts plaintext connections. The patched version disables HTTP and only listens on HTTPS.

Vulnerable Configuration (Nuki Bridge v1 < 1.22.0, v2 < 2.13.2):

# Example of vulnerable HTTP server setup (conceptual)
from http.server import HTTPServer, BaseHTTPRequestHandler

class NukiAPIHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        # Process API request without encryption
        token = self.headers.get('Authorization')
        if token == "valid_token":
            self.send_response(200)
            self.end_headers()
            self.wfile.write(b"OK")
        else:
            self.send_response(401)
            self.end_headers()

server = HTTPServer(('0.0.0.0', 80), NukiAPIHandler)
server.serve_forever()

Patched Configuration (Nuki Bridge v1 >= 1.22.0, v2 >= 2.13.2):

# Example of patched HTTPS server setup (conceptual)
from http.server import HTTPServer, BaseHTTPRequestHandler
import ssl

class NukiAPIHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        # Process API request with encryption
        token = self.headers.get('Authorization')
        if token == "valid_token":
            self.send_response(200)
            self.end_headers()
            self.wfile.write(b"OK")
        else:
            self.send_response(401)
            self.end_headers()

server = HTTPServer(('0.0.0.0', 443), NukiAPIHandler)
context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
context.load_cert_chain('/path/to/cert.pem', '/path/to/key.pem')
server.socket = context.wrap_socket(server.socket, server_side=True)
server.serve_forever()

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Obtain a Nuki Bridge v1 (firmware < 1.22.0) or v2 (firmware < 2.13.2).
2. Connect the Bridge to a local network (e.g., a lab Wi-Fi).
3. Use a laptop with network sniffing tools (e.g., Wireshark, tcpdump) on the same network.

Exploitation Steps:

1. Sniff Network Traffic: Start capturing traffic on the network interface.

   sudo tcpdump -i eth0 -w capture.pcap
   

2. Trigger Authentication: Have a legitimate user authenticate to the Bridge (e.g., via the Nuki app).
3. Extract Token: Analyze the pcap file for HTTP requests containing the Authorization header.

   tshark -r capture.pcap -Y "http.request" -T fields -e http.authorization
   

4. Replay Token: Use the captured token to make API calls.

   curl -X GET http://<bridge_ip>/api/lockState -H "Authorization: Bearer <captured_token>"
   

5. Gain Control: Execute commands to unlock doors, change settings, etc.

Blue Team (Defensive)

Detection:

• Monitor for multiple failed authentication attempts (though token reuse may succeed).
• Detect unusual API calls from unexpected IP addresses.
• Alert on plaintext HTTP traffic to the Bridge.

Prevention:

• Ensure the Bridge is updated to the latest firmware.
• Segment IoT devices on a separate VLAN with strict firewall rules.
• Use network monitoring tools to detect unencrypted traffic.

Indicators of Compromise (IOCs)

• Network Traffic: HTTP requests to the Bridge IP on port 80 containing Authorization headers.
• Logs: Unusual API calls (e.g., lock/unlock commands) from IPs not associated with legitimate users.
• Firmware Version: Bridge firmware versions below 1.22.0 (v1) or 2.13.2 (v2).

Detection Engineering

YARA Rule

rule CVE_2022_32510_Nuki_Bridge_Token_Sniffing {
    meta:
        description = "Detects HTTP traffic containing Nuki Bridge authentication tokens"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-32510"
    strings:
        $token = /Authorization: Bearer [A-Za-z0-9\-._~+/]+/ nocase
    condition:
        $token
}

Sigma Rule

title: Nuki Bridge Unencrypted API Token Detection
id: 8f7b3c2a-1d5e-4f6a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects plaintext HTTP requests to Nuki Bridge containing authentication tokens
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 80
        http.request_line: "*Authorization: Bearer*"
    condition: selection
falsepositives:
    - Legitimate use of HTTP (if any)
level: high

Suricata Rule

alert http any any -> any 80 (msg:"CVE-2022-32510 Nuki Bridge Token Sniffing"; flow:to_server; content:"Authorization: Bearer"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade Nuki Bridge firmware to v1.22.0 (v1) or v2.13.2 (v2) or later.
2. Network Segmentation: Place IoT devices like the Bridge on a separate VLAN with strict access controls.
3. Encryption Enforcement: Ensure all API communication uses HTTPS. Disable HTTP if possible.
4. Monitoring: Implement network monitoring to detect plaintext HTTP traffic to the Bridge.
5. Token Rotation: If a compromise is suspected, reset all tokens and force re-authentication.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert