Critical Authentication Bypass in Philips Hue Bridge (CVE-2026-3559) Threatens HomeKit IoT Devices

Critical Authentication Bypass in Philips Hue Bridge (CVE‑2026‑3559) Threatens HomeKit IoT Devices

What It Is – A static‑nonce flaw in the HomeKit Accessory Protocol (HAP) service of Philips Hue Bridge allows an attacker on the same network segment to bypass authentication entirely and issue arbitrary commands to the bridge.

Exploitability – The vulnerability is exploitable without credentials; a network‑adjacent attacker can craft a valid HAP request using the hard‑coded nonce. No public exploit code has been released, but the advisory confirms the flaw is trivial to weaponize. CVSS 8.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Affected Products – Philips Hue Bridge (any firmware prior to version 1975170000).

TPRM Impact – Compromised bridges can be used to pivot into corporate networks, manipulate lighting for physical security evasion, and violate compliance regimes that require authenticated IoT control.

Recommended Actions –

1. Deploy firmware 1975170000 or later on all Hue Bridges.
2. Segregate IoT devices onto isolated VLANs and restrict inbound traffic to TCP 8080.
3. Enforce network‑level ACLs or firewall rules limiting access to known management stations.
4. Monitor for anomalous HAP traffic and unexpected state changes in lighting systems.
5. Conduct an inventory of third‑party‑managed Philips Hue deployments and verify patch status.

Source: Zero Day Initiative Advisory ZDI‑26‑157