Yes—Nuki smart-lock vulnerabilities disclosed in 2022 were real, and some attack paths could lead to unauthorized lock control. But the headline did not mean that every Nuki lock could be opened remotely by anyone. The findings affected particular products and firmware versions, and Nuki released fixes in July 2022. In 2026, the practical question is whether each lock, Bridge, Keypad, and Fob is running supported, updated firmware.
What happened on July 27, 2022?
NCC Group reported 11 vulnerabilities affecting parts of the Nuki ecosystem, including Smart Lock products, Bridges, the Keypad, and the Fob. The researchers disclosed the issues to Nuki in April and May 2022. Nuki released fixes in July, and SecurityWeek published its report on July 27, 2022.
As an Amazon Associate I earn from qualifying purchases.
The vulnerabilities covered several security boundaries: Bluetooth Low Energy (BLE), local HTTP interfaces, communication with web services, and physical debug connections on hardware. Their potential effects ranged from denial of service and exposed information to altered commands, arbitrary code execution, and—in particular attack scenarios—unauthorized operation of the lock.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →There is no evidence in the cited reporting that these flaws were being widely exploited by criminals in the wild. They were security research findings and technically assessed attack paths, not proof that attackers were routinely opening homes.
#1 Best Overall
- Complete smart access solution: Unlock your door with your smartphone, fingerprint, entry code, NFC, Apple Home Key*, Samsung Digital Home Key*, or Auto Unlock. The Nuki Smart Lock and Keypad give you flexible, keyless access for everyday life.
- Easy retrofit installation: Install the Smart Lock over your existing deadbolt in under 15 minutes. Mount the wireless Keypad outside using adhesive strips or screws. No drilling, wiring, or lock replacement required.
- Flexible access management: Share digital keys, create up to 200 entry codes, store up to 20 fingerprints and 35 Tap to Unlock keys. Manage users, permissions, and activity anytime in the free Nuki app.
- Smart home ready: Works seamlessly with Apple Home, Alexa, Google Home, and SmartThings. Supporting Bluetooth, Wi-Fi, and Matter over Thread for reliable connectivity and future-proof smart home integration.
- Secure by design: Engineered in Europe with bank-level encryption, end-to-end protected communication, tamper alerts, and local data storage. The weather-resistant IP54 Keypad and rechargeable Smart Lock are built to last.
The important distinction: vulnerable firmware versus “any Nuki lock”
The phrase “hackers can open Nuki locks” is too broad without explaining the conditions. The 2022 research did not establish that an arbitrary internet attacker could open every Nuki door. Different flaws required different kinds of access:
| Attacker position or capability | Relevant attack surface | Potential consequence |
|---|---|---|
| Access to the same local network | Local HTTP or API services | Service disruption, altered communication, or exploitation of vulnerable parsing code |
| Bluetooth proximity | BLE communications and access controls | Unauthorized commands or denial of service, depending on the flaw |
| A position for intercepting traffic | Device-to-service communications without proper certificate validation | Traffic inspection or modification |
| Physical access to exposed hardware points | JTAG or SWD debug interfaces | A route around software protections or access to device internals |
| Access to relevant Nuki server infrastructure | Cloud-supported services | A potentially broader compromise scenario described by the researchers |
These are not interchangeable scenarios. Someone standing outside a house is not automatically able to exploit every issue. A Bluetooth attack depends on proximity and the relevant device behavior; a local-network attack requires network access; and a debug-interface attack requires physical access to the hardware.
Which vulnerabilities were most serious?
NCC Group’s advisory described a mixture of confidentiality, integrity, availability, and physical-security problems. The issues most relevant to the claim that a lock could be opened were the following.
Missing TLS certificate validation
CVE-2022-32509 concerned missing TLS certificate validation in affected Smart Lock 3.0 and Bridge versions. If an attacker could position themselves to intercept communications, they could potentially proxy, inspect, or modify traffic that the device trusted.
This is not the same as an internet-wide remote unlock vulnerability. It depends on a capable interception position and on the affected firmware.
Rank #2
- Convenient access: Unlock your door with NFC, fingerprint, or a custom entry code by simply pairing the keypad with your compatible Nuki Smart Lock and upgrade to the next level of easy home access.
- Smart wallet integration: Use Apple home key*, Samsung Digital Home Key, or Nuki App Mode for keyless NFC entry. A compatible Nuki Smart Lock, a Matter hub (for wallet use) and a NFC-capable smartphone, are required.
- Maximum flexibility: Use the Nuki App to create and manage up to 35 Tap to Unlock keys, 20 fingerprints, and 200 individual entry codes. Perfect for granting easy access to family, friends, or service providers.
- Easy installation and outstanding quality: Simple self-installation with the included adhesive strips or screws - no wiring needed. The IP54-rated, weather-resistant design and 12-month battery life ensure durable operation.
- Maximum data security: All Nuki access data is stored locally - the cloud remains optional. Every tap, fingerprint, and code is protected by Nuki’s end-to-end encryption.
Buffer overflows in message parsing
The advisory described stack buffer overflows while parsing JSON responses and HTTP parameters. One of the documented issues, CVE-2022-32504, affected specific Smart Lock 2.0, Smart Lock 3.0, Bridge v1, and Bridge v2 firmware versions. Crafted or modified input could potentially lead to arbitrary code execution.
Arbitrary code execution is a serious capability because it can allow an attacker to make a device perform actions outside its intended logic. The exact consequence still depends on the attack path, device state, and privileges available to the resulting code.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Broken BLE access controls
CVE-2022-32507 concerned broken access controls in the BLE protocol for Smart Lock 2.0 and 3.0. NCC Group reported that commands intended for privileged users could potentially be sent by a less-privileged Bluetooth-connected device, including a keypad.
This finding matters because a smart lock is not secured only by its main app. Every accessory and communications path that can issue or relay commands is part of the access-control boundary.
Exposed JTAG and SWD interfaces
NCC Group also identified exposed hardware debugging interfaces. JTAG test points were reported on affected Keypad and Fob versions, while exposed SWD interfaces were identified as a physical-access concern on Nuki hardware.
Rank #3
- Unlock via fingerprint - With Nuki Keypad 2 you can open your Nuki Smart Lock with just one finger. Unlock your front door via fingerprint or by entering a 6-digit-entry code for keyless entry.
- Easy setup - Mount the Nuki Keypad 2 in minutes. Simply stick it to the wall outside, next to your front door. Dust- and water-resistent, it withstands -4°F to +158°F for year-round durability.
- Access sharing - Save and manage up to 20 fingerprints and 200 access codes and share them with whoever needs access — your pet sitter, housekeeper, repairman, visitors, friends and family.
- Battery powered - Keypad 2 is battery powered, meaning you don’t have to connect any wires or cables during installation. The four included AAA batteries last up to 12 months, depending on usage.
- Highest security - The Keypad 2 uses bank-level encryption, ensuring that the fingerprints and codes you store are safely encrypted and diminishing the risk of hacking and unauthorized access.
A physical-debug issue is more relevant when an attacker can obtain and work on the device—for example, an accessory mounted in an exposed location—than when the lock hardware is inside a secured home. It should not be described as a wireless attack.
Denial of service and information exposure
Other findings included unauthenticated BLE and HTTP denial-of-service issues, sensitive data sent over an unencrypted channel, an insecure invite-key implementation, and an unauthenticated opener-name overwrite. These do not all open a door.
A denial-of-service flaw may prevent normal electronic operation without granting an attacker the ability to unlock the lock. Changing an opener name is an integrity problem, but it is not evidence of a door-opening vulnerability. The consequences must therefore be assessed issue by issue rather than collapsed into one dramatic claim.
Affected products and the 2022 fixed-version thresholds
The following thresholds come from the NCC Group advisory. They are the minimum versions associated with the 2022 fixes—not necessarily the current firmware versions in September 2026.
| Product | Issue or issues cited | Fixed-version threshold associated with the 2022 disclosure |
|---|---|---|
| Smart Lock 3.0 | Missing TLS certificate validation; JSON parsing overflow | 3.3.5 or later |
| Smart Lock 2.0 | JSON parsing overflow | 2.12.4 or later |
| Bridge v1 | Missing TLS certificate validation; JSON parsing overflow | 1.22.0 or later |
| Bridge v2 | Missing TLS certificate validation; JSON parsing overflow | 2.13.2 or later |
| Keypad | Exposed JTAG test points | 1.9.2 or later |
| Fob | Exposed JTAG test points | 1.8.1 or later |
Other NCC Group findings had broader or more product-specific scope. Owners should consult the original advisory rather than assume that the table covers every CVE or every firmware line.
Rank #4
- 7 in 1 Keyless Entry Door Lock: Fingerprint ID(stores up to 50 fingerprints) + Passcodes(up to 50) + Smartphone App(compatible with Android and iOS) + Web Portal + EKey / Code Sharing + Voice Control with Siri, Alexa or Google Assistant + 2 Mechanical Keys
- App Control via Built-in WiFi: Remotely lock, unlock, and manage your smart lock from anywhere. Share permanent, scheduled, or temporary eKeys and passcodes with family, guests, or service providers. Manage up to 50 fingerprints and 50 access codes, view activity history, and receive real-time notifications—all without a hub. Supports 2.4 GHz Wi-Fi only. For optimal connectivity, keep your router within 70 ft of the lock.
- Remote Access via Matter over Thread: Remotely lock, unlock, and manage your smart lock through Apple Home or other Matter-compatible apps. Enjoy simple setup, real-time notifications, event history, and secure access management—all from your smartphone. Requires a compatible Matter over Thread hub (Thread Border Router).
- Effortless Matter Smart Home Integration: Ultraloq matter smart lock seamlessly integrates with all matter-enabled ecosystems. Voice control with Siri, Alexa and Google Assistant. It can be used to automate your smart home by pairing multiple matter-enabled devices through the one app. No more compatibility headaches. Requires a compatible Matter over Thread hub (Thread Border Router).
- Reliable Connection: Enjoy fast, stable, and responsive communication with Matter over Thread. The self-healing mesh network automatically reroutes connections if a device becomes unavailable, helping keep your smart home connected with minimal interruptions. Requires a compatible Matter over Thread hub (Thread Border Router).
Did Nuki fix the vulnerabilities?
Nuki’s security-update page records the 2022 remediation and tells customers to keep their devices updated. The contemporary reporting stated that customers were notified through the Nuki smartphone app and that patches were released in July 2022.
Nuki’s current support material also lists later firmware lines for newer Smart Lock generations. That is relevant evidence that the products have continued to receive updates, but it does not justify declaring every current device universally secure. A patched device can still be exposed through a compromised account, stolen phone, weak Wi-Fi credentials, an unauthorized virtual key, a malicious integration, or a new vulnerability.
The safest present-day conclusion is simple: unpatched legacy firmware was demonstrably vulnerable, while the current risk depends on the exact device, firmware, support status, installation, account, and network.
What Nuki owners should do now
- Check every device separately. In the Nuki app, inspect the Smart Lock, each Bridge, the Keypad, and the Fob. Record the model, generation, and firmware version. Accessories are part of the security boundary and may update independently.
- Install all available updates. Use Nuki’s current update process and do not rely on the device’s purchase date or assume that a lock that operates normally is fully patched. Compare legacy firmware against the fixed thresholds above, while treating Nuki’s latest available release—not the 2022 threshold—as the target.
- Resolve unsupported hardware. If a device cannot update to a fixed version or no longer receives security updates, contact Nuki support before relying on it for security-critical access. Replacement may be appropriate when the issue cannot be remediated.
- Secure the local network. Use a current router with WPA2 or WPA3, change default router credentials, keep router firmware current, and do not expose management interfaces to the public internet. Avoid placing a lock or Bridge on a poorly controlled shared network.
- Review digital access. Remove former residents, contractors, guests, and unused virtual keys. Change account credentials if compromise is suspected, and enable available account protections such as multifactor authentication where supported.
- Keep a mechanical fallback. Maintain a working mechanical key or another recovery method. Confirm that the door can still be opened if the lock loses power, connectivity, or suffers a denial-of-service condition.
Do not assume that disabling Bluetooth fixes every issue: the 2022 findings covered more than one interface. A factory reset also should not be treated as a substitute for a firmware update, because resetting settings does not necessarily repair vulnerable device code.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What this means for builders, landlords, and property managers
For construction and property projects, a smart lock should be treated as an access-control system rather than a standalone gadget. Specify who owns the Nuki account, how former workers and tenants are removed, how firmware is monitored, where Bridges and Keypads are installed, and what happens during a power or connectivity failure.
Best Value
- Effortless Entry, Lasting Clarity: Unlock in 0.5 seconds with Wyze Lock Bolt v2's fingerprint scanner. Its scratch and smudge-resistant tempered glass ensures reliable reads and maintains a pristine look.
- The Lock That Learns with You: Our AI smart lock learns from every touch, constantly improving to deliver faster, more accurate recognition over time. This eliminates failed scans and creates a seamlessly adaptive entry experience just for you.
- 8-Month Power with Emergency Backup: Includes 8 AA batteries for up to 8 months of use. If batteries die, the USB-C port lets you power it with any common power bank to unlock the door.
- Total Control in the Wyze App: Remotely check and manage your lock via built-in Wi-Fi. When paired with a Wyze Video Doorbell, unlock directly from the live feed to visually verify and welcome visitors instantly.
- Your Door, Your Way: Enjoy total unlocking freedom. Choose what fits your moment: fingerprint for speed, the app for control, a code for convenience, or the physical keys as a guaranteed backup. Experience ultimate flexibility and peace of mind.
Physical installation matters too. A properly updated lock can still be undermined by a weak door, cylinder, frame, emergency-release configuration, exposed accessory, or uncontrolled service area. For rental properties and multi-tenant buildings, maintain an access register and a documented revocation process rather than relying on informal app sharing.
Is a Nuki lock still worth considering?
The 2022 vulnerabilities are a reason to verify support and update practices, not by themselves proof that every Nuki product should be rejected. A buyer should evaluate:
- how long the specific model is expected to receive security updates;
- whether updates are delivered reliably and whether the vendor publishes security information;
- which functions depend on Bluetooth, the local network, cloud services, or smart-home integrations;
- whether the door and cylinder are compatible in the relevant country;
- whether the installation retains a mechanical or offline fallback;
- how easily accounts, phones, integrations, and virtual keys can be revoked; and
- whether external accessories add convenience without being installed in an uncontrolled location.
Nuki’s retrofit-oriented European products are not directly interchangeable with every U.S. deadbolt-focused alternative. Aqara, Yale, and August products vary by country, door hardware, connectivity model, and update policy. A competing lock should not be called safer without current, product-specific evidence.
Nor should buying a newer Nuki model be treated as a guarantee against all smart-lock risks. More remote-control and smart-home features can introduce additional configuration and cloud dependencies.
The bottom line
The 2022 headline had a factual basis, but it needs a date and a threat model. NCC Group found serious vulnerabilities in particular Nuki products and firmware versions, including paths that could potentially enable unauthorized lock control under conditions involving local-network access, Bluetooth proximity, traffic interception, server access, or physical access to hardware.
Nuki released fixes in July 2022. Owners should therefore check every Nuki component, install the latest supported firmware, remove stale digital access, secure the network and account, and replace hardware that cannot be updated. A current, supported Nuki installation is a different security question from an unpatched 2022-era device.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
