Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-32457 State: PUBLISHED Published: 2022-07-20T02:01:03.596648Z Last Updated: 2024-09-16T22:35:56.260Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Data Systems Consulting Co., Ltd. Products: BPM Problem Types: CWE-918 Description: Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-6287-20ef0-1.html - https://www.chtsecurity.com/news/09757883-fea6-4aff-9e22-8ae8c4f8f7bb
CVE ID: CVE-2022-32458 State: PUBLISHED Published: 2022-07-20T02:01:30.078613Z Last Updated: 2024-09-16T18:39:22.085Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Data Systems Consulting Co., Ltd. Products: BPM Problem Types: CWE-611 Description: Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-6288-49e01-1.html - https://www.chtsecurity.com/news/09757883-fea6-4aff-9e22-8ae8c4f8f7bb
CVE ID: CVE-2022-32469 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-05-05T16:16:34.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the PnpSmm shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated using IOMMU protection for the ACPI runtime memory used for the command buffer. This attack can be mitigated by copying the firmware block services data to SMRAM before checking it. Additional Analyst Notes: - CVE Program Container: - CISA ADP V
irmware block services data to SMRAM before checking it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2023001
CVE ID: CVE-2022-32470 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-05-05T16:16:25.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the FwBlockServiceSmm shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated using IOMMU protection for the ACPI runtime memory used for the command buffer. This attack can be mitigated by copying the firmware block services data to SMRAM before checking it. Additional Analyst Notes: - CVE Program Container: -
pying the firmware block services data to SMRAM before checking it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2023002
CVE ID: CVE-2022-32471 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-05-05T16:16:16.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. The IhisiDxe driver uses the command buffer to pass input and output data. By modifying the command buffer contents with DMA after the input parameters have been checked but before they are used, the IHISI SMM code may be convinced to modify SMRAM or OS, leading to possible data corruption or escalation of privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2023003
CVE ID: CVE-2022-32472 State: REJECTED Published: N/A Last Updated: 2023-01-27T00:00:00 Description: No description available.
CVE ID: CVE-2022-32473 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-03-20T13:41:33.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the HddPassword shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated using IOMMU protection for the ACPI runtime memory used for the command buffer. This attack can be mitigated by copying the firmware block services data to SMRAM before checking it. Additional Analyst Notes: - CVE Program Container: - CISA
the firmware block services data to SMRAM before checking it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2023005
CVE ID: CVE-2022-32474 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-03-20T13:40:48.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the StorageSecurityCommandDxe shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated using IOMMU protection for the ACPI runtime memory used for the command buffer. This attack can be mitigated by copying the firmware block services data to SMRAM before checking it. Additional Analyst Notes: - CVE Program Cont
ed by copying the firmware block services data to SMRAM before checking it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2023006
CVE ID: CVE-2022-32475 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-05-05T16:16:08.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the VariableRuntimeDxe shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This issue was fixed in the kernel, which also protected chipset and OEM chipset code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-20
SA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2023007
CVE ID: CVE-2022-32476 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-03-20T13:40:03.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the AhciBusDxe shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated using IOMMU protection for the ACPI runtime memory used for the command buffer. This attack can be mitigated by copying the firmware block services data to SMRAM before checking it. Additional Analyst Notes: - CVE Program Container: - CISA A
he firmware block services data to SMRAM before checking it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2023008
CVE ID: CVE-2022-32477 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-05-05T16:15:58.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the FvbServicesRuntimeDxe shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated using IOMMU protection for the ACPI runtime memory used for the command buffer. This attack can be mitigated by copying the firmware block services data to SMRAM before checking it. Additional Analyst Notes: - CVE Program Containe
y copying the firmware block services data to SMRAM before checking it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2023009
CVE ID: CVE-2022-32478 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-03-19T19:18:24.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the IdeBusDxe shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated using IOMMU protection for the ACPI runtime memory used for the command buffer. This attack can be mitigated by copying the firmware block services data to SMRAM before checking it. Additional Analyst Notes: - CVE Program Container: - CISA AD
e firmware block services data to SMRAM before checking it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2023010
CVE ID: CVE-2022-32479 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-32480 State: PUBLISHED Published: 2022-08-22T16:50:55.935679Z Last Updated: 2024-09-16T23:05:58.156Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-1188 Description: Dell PowerScale OneFS, versions 9.0.0, up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain an insecure default initialization of a resource vulnerability. A remote authenticated attacker may potentially exploit this vulnerability, leading to information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000201094/dsa-2022-149-dell-emc-powerscal
CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000201094/dsa-2022-149-dell-emc-powerscale-onefs-security-update?lang=en
CVE ID: CVE-2022-32481 State: PUBLISHED Published: 2022-07-07T22:05:11.954562Z Last Updated: 2024-09-17T04:10:02.689Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Cyber Recovery Problem Types: Other Description: Dell PowerProtect Cyber Recovery, versions prior to 19.11, contain a privilege escalation vulnerability on virtual appliance deployments. A lower-privileged authenticated user can chain docker commands to escalate privileges to root leading to complete system takeover. Additional Analyst Notes: - CVE Program Container: References: - https://support.emc.com/kb/000201213
CVE ID: CVE-2022-32482 State: PUBLISHED Published: 2023-02-01T05:15:33.850Z Last Updated: 2025-03-26T18:55:52.431Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L) Vendors: Dell Products: CPG BIOS Problem Types: CWE-20 Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000205717/dsa-2022-326
CVE ID: CVE-2022-32483 State: PUBLISHED Published: 2022-10-12T19:25:34.041Z Last Updated: 2025-05-16T13:41:28.798Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L) Vendors: Dell Products: CPG BIOS Problem Types: CWE-20 Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/000203758
CVE ID: CVE-2022-32484 State: PUBLISHED Published: 2022-10-12T19:25:35.052Z Last Updated: 2025-05-16T13:45:40.604Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L) Vendors: Dell Products: CPG BIOS Problem Types: CWE-20 Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/000203758
CVE ID: CVE-2022-32485 State: PUBLISHED Published: 2022-10-12T19:25:36.061Z Last Updated: 2025-05-16T13:45:24.559Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: CPG BIOS Problem Types: CWE-20 Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/000203758
CVE ID: CVE-2022-32486 State: PUBLISHED Published: 2022-10-11T16:40:16.340Z Last Updated: 2025-05-16T13:48:19.408Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: CPG BIOS Problem Types: CWE-20 Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/000202772
CVE ID: CVE-2022-32487 State: PUBLISHED Published: 2022-10-12T19:25:37.340Z Last Updated: 2025-05-15T17:48:03.891Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: CPG BIOS Problem Types: CWE-20 Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/000203758
CVE ID: CVE-2022-32488 State: PUBLISHED Published: 2022-10-12T19:25:38.371Z Last Updated: 2025-05-15T15:38:42.567Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: CPG BIOS Problem Types: CWE-20 Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/000203758
CVE ID: CVE-2022-32489 State: PUBLISHED Published: 2022-10-12T19:25:39.321Z Last Updated: 2025-05-15T15:38:26.491Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: CPG BIOS Problem Types: CWE-20 Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/000203758
CVE ID: CVE-2022-32490 State: PUBLISHED Published: 2023-01-18T05:59:52.888Z Last Updated: 2025-04-03T19:43:07.139Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: BIOS Problem Types: CWE-20 Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/000204685
CVE ID: CVE-2022-32491 State: PUBLISHED Published: 2022-10-12T19:25:40.329Z Last Updated: 2025-05-15T15:35:57.917Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: CPG BIOS Problem Types: CWE-119 Description: Dell Client BIOS contains a Buffer Overflow vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by manipulating an SMI to cause an arbitrary write during SMM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/000203758
CVE ID: CVE-2022-32492 State: PUBLISHED Published: 2022-10-11T16:40:17.390Z Last Updated: 2025-05-16T13:48:00.175Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: CPG BIOS Problem Types: CWE-20 Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/000202772
CVE ID: CVE-2022-32493 State: PUBLISHED Published: 2022-10-12T19:25:41.419Z Last Updated: 2025-05-15T15:35:38.338Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Dell Products: CPG BIOS Problem Types: CWE-121 Description: Dell BIOS contains an Stack-Based Buffer Overflow vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/000203758
CVE ID: CVE-2022-32494 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-32495 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-32496 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-32497 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-32498 State: PUBLISHED Published: 2022-07-20T20:55:24.343479Z Last Updated: 2024-09-17T01:41:21.354Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: Dell Products: PowerStore Problem Types: CWE-427 Description: Dell EMC PowerStore, Versions prior to v3.0.0.0 contain a DLL Hijacking vulnerability in PSTCLI. A local attacker can potentially exploit this vulnerability to execute arbitrary code, escalate privileges, and bypass software allow list solutions, leading to system takeover or IP exposure. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000201283
CVE ID: CVE-2022-32502 State: PUBLISHED Published: 2024-05-09T19:37:08.770Z Last Updated: 2025-02-13T15:46:23.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on certain Nuki Home Solutions devices. There is a buffer overflow over the encrypted token parsing logic in the HTTP service that allows remote code execution. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-202
e-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/ - https://www.hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options/ - https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/ - https://nuki.io/en/security-updates/
CVE ID: CVE-2022-32503 State: PUBLISHED Published: 2024-05-09T19:42:20.782Z Last Updated: 2025-02-13T15:46:23.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on certain Nuki Home Solutions devices. An attacker with physical access to this JTAG port may be able to connect to the device and bypass both hardware and software security protections. This affects Nuki Keypad before 1.9.2 and Nuki Fob before 1.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-
5/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/ - https://www.hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options/ - https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/ - https://nuki.io/en/security-updates/
CVE ID: CVE-2022-32504 State: PUBLISHED Published: 2024-05-09T19:33:56.851Z Last Updated: 2025-02-13T15:46:24.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on certain Nuki Home Solutions devices. The code used to parse the JSON objects received from the WebSocket service provided by the device leads to a stack buffer overflow. An attacker would be able to exploit this to gain arbitrary code execution on a KeyTurner device. This affects Nuki Smart Lock 3.0 before 3.3.5 and 2.0 before 2.12.4, as well as Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://re
d v2 before 2.13.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/ - https://www.hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options/ - https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/ - https://nuki.io/en/security-updates/
CVE ID: CVE-2022-32505 State: PUBLISHED Published: 2024-05-09T19:51:38.689Z Last Updated: 2025-03-13T16:07:17.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on certain Nuki Home Solutions devices. It is possible to send multiple BLE malformed packets to block some of the functionality and reboot the device. This affects Nuki Smart Lock 3.0 before 3.3.5 and Nuki Smart Lock 2.0 before 2.12.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-3
sory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/ - https://www.hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options/ - https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/ - https://nuki.io/en/security-updates/