You do not have permission to edit this page, for the following reasons:
Overall assessment: Nuki combines a high number of disclosed flaws with strong vendor governance. NCC Group disclosed nine CVEs affecting the Smart Lock 3.0 line before firmware 3.3.5, two of them at CVSS 8.8: CVE-2022-32509 (HTTP communications do not validate certificates, allowing interception on the local network) and CVE-2022-32507 (BLE commands reserved for privileged accounts could be called from unprivileged ones because access control was never implemented). These were fixed in firmware 3.3.5 and Nuki maintains a public security updates page with a responsible disclosure process. The account model is the strongest in this batch: owner, administrator and regular user roles are separated, invitations are revocable, and the app keeps a per-user activity log recording who unlocked the door and when. No in-the-wild campaign was found - CISA lists only public proof of concept and EPSS stays near 0.5 percent - which keeps the final rating at B despite the high CVE count. [[Category:Classification]] [[Category:Calculator v1]] [[Category:Nuki]]
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
