Nuki Smart Lock 3.0 Pro (SL3P)

Nuki Smart Lock 3.0 Pro (SL3P)
Security Grade B Calculator v1	Nuki Smart Lock 3.0 Pro Brand: Nuki (Parent: Nuki Home Solutions GmbH) Category: Smart lock • Model / Gen: Smart Lock 3.0 Pro SL3P Release Date: 2022-01-01 • Status: In sale Classification Date: 2026-10-31 • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	The lock is mounted on the inside of the door and the retrofit design can be removed from the cylinder, but NCC Group did not report an exposed physical debug interface.
Known vulnerabilities	Very common	🔗 Proof	NCC Group disclosed nine CVEs affecting Nuki Smart Lock 3.0 before firmware 3.3.5, including CVE-2022-32509 (CVSS 8.8, missing certificate validation on HTTP communications) and CVE-2022-32507 (CVSS 8.8, BLE commands reserved for privileged accounts can be called from unprivileged ones because no access control was implemented).
Prior attacks	Rare	🔗 Proof	CISA records the exploitation stage as public proof of concept, EPSS is around 0.5 percent and the CVEs are not in KEV, so no in-the-wild campaign was found.
Updatability	Very common	🔗 Proof	Nuki published firmware 3.3.5 for the Smart Lock 3.0 line and maintains a public security updates page with a responsible disclosure process
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Matter commissioning and the bridge use certificates, but CVE-2022-32509 shows that HTTP communications do not validate certificates, which allows interception and tampering on the local network.
Communications	Encrypted with obselete encryption	🔗 Proof	Traffic is encrypted but the missing certificate validation documented in CVE-2022-32509 makes the channel trivially interceptable by an attacker on the same network.
Storage	Encrypted with obselete encryption	🔗 Proof	No vendor documentation of encryption at rest for stored credentials, keys and the local access log.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Nuki separates owner, administrator and regular user roles and can issue revocable invitations, so permissions are managed per person.
Authentication	Basic	🔗 Proof	Authentication exists for the app and the bridge, but CVE-2022-32507 shows that BLE commands were never restricted per account, so the mechanism was not consistently enforced.
Brute-force protection	Basic	🔗 Proof	No published documentation of failed-attempt lockout on the local interfaces or the BLE channel.
Event logging	Access event logged	🔗 Proof	The app keeps a per-user activity log recording who unlocked the door and when, which is a genuine access event trail.
Passwords	Require change after setup	🔗 Proof	Access depends on the Nuki account created during setup; no enforced complexity policy is published.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Embedded firmware (Companion App: Nuki app (iOS / Android))
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: Rechargeable lithium polymer, several months per charge • Power: Battery, USB-C charging • Charging: USB-C
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Bluetooth LE, Wi-Fi 2.4 GHz, Matter over Thread
Physical (Dimensions & Mass)	Dimensions: approx. 110 x 70 x 70 mm • Mass: approx. 400 g

Overall assessment: Nuki combines a high number of disclosed flaws with strong vendor governance. NCC Group disclosed nine CVEs affecting the Smart Lock 3.0 line before firmware 3.3.5, two of them at CVSS 8.8: CVE-2022-32509 (HTTP communications do not validate certificates, allowing interception on the local network) and CVE-2022-32507 (BLE commands reserved for privileged accounts could be called from unprivileged ones because access control was never implemented). These were fixed in firmware 3.3.5 and Nuki maintains a public security updates page with a responsible disclosure process. The account model is the strongest in this batch: owner, administrator and regular user roles are separated, invitations are revocable, and the app keeps a per-user activity log recording who unlocked the door and when. No in-the-wild campaign was found - CISA lists only public proof of concept and EPSS stays near 0.5 percent - which keeps the final rating at B despite the high CVE count.