Critical SQL Injection RCE in Philips Hue Bridge Pro (CVE‑2026‑118632) Threatens Smart‑Home Devices
What It Is — The Zero Day Initiative disclosed CVE‑2026‑118632, an SQL‑injection flaw in the HTTP service of the Philips Hue Bridge Pro. The vulnerability allows a network‑adjacent attacker, who can bypass the device’s authentication, to inject malicious SQL that is executed with root privileges, leading to remote code execution. The issue resides in the handling of user‑supplied strings on TCP 443. CVSS 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Philips released firmware 6.1.2071524030 (or later) to remediate the flaw.
Affected Products — Philips Hue Bridge Pro (all firmware versions prior to 6.1.2071524030).
Why It Matters for Trust & Control Assurance — This incident tests the control objective of secure configuration and vulnerability management; continuous evidence of patch status is essential to demonstrate compliance across IoT assets.
Recommended Actions —
- Upgrade all Hue Bridge Pro devices to firmware 6.1.2071524030 or later.
- Verify the firmware version via device inventory tools.
- Incorporate the bridge into your organization’s vulnerability‑scanning scope.
- Document the remediation in your change‑management and audit logs.
Source: Zero Day Initiative Advisory