Critical Authentication Bypass in Philips Hue Bridge (CVE‑2026‑3558) Threatens HomeKit IoT Devices
What It Is – A high‑severity (CVSS 8.1) authentication‑bypass flaw in the HomeKit Accessory Protocol of the Philips Hue Bridge allows network‑adjacent attackers to interact with the device without any credentials. The vulnerability is tracked as CVE‑2026‑3558 and was disclosed through a Pwn2Own demonstration.
Exploitability – The bug can be triggered over the local network (TCP 8080) with no authentication, low attack complexity, and no user interaction required. No public exploit has been released, but a proof‑of‑concept was shown at Pwn2Own, indicating active interest from attackers.
Affected Products – Philips Hue Bridge (any firmware prior to version 1975170000).
TPRM Impact – Enterprises that deploy Hue lighting in offices expose a foothold for adversaries to pivot into corporate networks, potentially exfiltrating data or manipulating device behavior. The flaw also raises supply‑chain concerns for vendors integrating Hue devices into broader smart‑building solutions.
Recommended Actions –
- Deploy the Philips firmware update (Bridge v2 1975170000) immediately.
- Segregate Hue Bridges onto a dedicated VLAN or isolated IoT network.
- Block inbound traffic to TCP 8080 from untrusted segments.
- Enable continuous monitoring for anomalous traffic to the Bridge.
- Review zero‑trust policies for all IoT assets and update asset inventories.