| Nuki Smart Lock 3.0 Pro (SL3P)
|
|
Security Grade
Calculator v1
|
Nuki Smart Lock 3.0 Pro
Category: Smart lock • Model / Gen: Smart Lock 3.0 Pro SL3P
Release Date: 2022-01-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
The lock is mounted on the inside of the door and the retrofit design can be removed from the cylinder, but NCC Group did not report an exposed physical debug interface.
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
NCC Group disclosed nine CVEs affecting Nuki Smart Lock 3.0 before firmware 3.3.5, including CVE-2022-32509 (CVSS 8.8, missing certificate validation on HTTP communications) and CVE-2022-32507 (CVSS 8.8, BLE commands reserved for privileged accounts can be called from unprivileged ones because no access control was implemented).
|
| Prior attacks
|
Rare
|
🔗 Proof
|
CISA records the exploitation stage as public proof of concept, EPSS is around 0.5 percent and the CVEs are not in KEV, so no in-the-wild campaign was found.
|
| Updatability
|
Very common
|
🔗 Proof
|
Nuki published firmware 3.3.5 for the Smart Lock 3.0 line and maintains a public security updates page with a responsible disclosure process
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Matter commissioning and the bridge use certificates, but CVE-2022-32509 shows that HTTP communications do not validate certificates, which allows interception and tampering on the local network.
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
Traffic is encrypted but the missing certificate validation documented in CVE-2022-32509 makes the channel trivially interceptable by an attacker on the same network.
|
| Storage
|
Encrypted with obselete encryption
|
🔗 Proof
|
No vendor documentation of encryption at rest for stored credentials, keys and the local access log.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
🔗 Proof
|
Nuki separates owner, administrator and regular user roles and can issue revocable invitations, so permissions are managed per person.
|
| Authentication
|
Basic
|
🔗 Proof
|
Authentication exists for the app and the bridge, but CVE-2022-32507 shows that BLE commands were never restricted per account, so the mechanism was not consistently enforced.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
No published documentation of failed-attempt lockout on the local interfaces or the BLE channel.
|
| Event logging
|
Access event logged
|
🔗 Proof
|
The app keeps a per-user activity log recording who unlocked the door and when, which is a genuine access event trail.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
Access depends on the Nuki account created during setup; no enforced complexity policy is published.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded firmware (Companion App: Nuki app (iOS / Android))
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: Rechargeable lithium polymer, several months per charge • Power: Battery, USB-C charging • Charging: USB-C
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Bluetooth LE, Wi-Fi 2.4 GHz, Matter over Thread
|
| Physical (Dimensions & Mass)
|
Dimensions: approx. 110 x 70 x 70 mm • Mass: approx. 400 g
|
Overall assessment: Nuki combines a high number of disclosed flaws with strong vendor governance. NCC Group disclosed nine CVEs affecting the Smart Lock 3.0 line before firmware 3.3.5, two of them at CVSS 8.8: CVE-2022-32509 (HTTP communications do not validate certificates, allowing interception on the local network) and CVE-2022-32507 (BLE commands reserved for privileged accounts could be called from unprivileged ones because access control was never implemented). These were fixed in firmware 3.3.5 and Nuki maintains a public security updates page with a responsible disclosure process. The account model is the strongest in this batch: owner, administrator and regular user roles are separated, invitations are revocable, and the app keeps a per-user activity log recording who unlocked the door and when. No in-the-wild campaign was found - CISA lists only public proof of concept and EPSS stays near 0.5 percent - which keeps the final rating at B despite the high CVE count.
