Critical Remote Code Execution in Philips Hue Bridge (CVE-2026-3561) Threatens Smart‑Lighting Supply Chains

Critical Remote Code Execution in Philips Hue Bridge (CVE‑2026‑3561) Threatens Smart‑Lighting Supply Chains

What It Is – A heap‑based buffer overflow in the hk_hap characteristics endpoint of the Philips Hue Bridge allows an attacker to bypass authentication and execute arbitrary code on the device.

Exploitability – The vulnerability is network‑adjacent; a proof‑of‑concept was demonstrated at Pwn2Own. CVSS 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates high severity and active exploit potential.

Affected Products – Philips Hue Bridge (all firmware versions prior to v2 1975170000).

TPRM Impact – Compromise of a widely deployed IoT hub can cascade to downstream customers, expose corporate network segments, and enable ransomware or data exfiltration via the bridge’s privileged position in smart‑building environments.

Recommended Actions –

1. Verify firmware version on every Hue Bridge; upgrade to v2 1975170000 or later immediately.
2. Segment IoT devices on a dedicated VLAN and enforce strict firewall rules limiting inbound traffic to management ports.
3. Disable unnecessary external access to the bridge’s REST API (e.g., block inbound HTTP/HTTPS from the internet).
4. Incorporate the Hue Bridge into your asset inventory and continuous vulnerability scanning program.
5. Review third‑party risk contracts with Philips for security‑by‑design clauses and incident‑response obligations.

Source: Zero Day Initiative Advisory ZDI‑26‑159