SB2026030925 - Multiple vulnerabilities in Philips Hue Bridge

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026030925

SB2026030925 - Multiple vulnerabilities in Philips Hue Bridge

Published: March 9, 2026

Security Bulletin ID SB2026030925
Severity
Medium
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Adjecent network
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 secuirty vulnerabilities.


1) Heap-based buffer overflow (CVE-ID: CVE-2026-3555)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the handling of custom Zigbee ZCL frames in the Model Info download functionality. A remote attacker on the local network can wait for user to initiate the device pairing process, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-3562)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to improper verification of a cryptographic signature within the ed25519_sign_open function. A remote attacker on the local network can bypass authentication process and gain unauthorized access to the application.


3) Heap-based buffer overflow (CVE-ID: CVE-2026-3561)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the handling of PUT requests to the characteristics endpoint. A remote user on the local network can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


4) Heap-based buffer overflow (CVE-ID: CVE-2026-3560)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the hk_hap_pair_storage_put function of the HomeKit implementation. A remote attacker on the local network can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


5) Improper Authentication (CVE-ID: CVE-2026-3559)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when processing authentication requests within the configuration of the SRP authentication mechanism in the HomeKit Accessory Protocol service. A remote attacker on the local network can bypass authentication process and gain unauthorized access to the application.


6) Improper Authentication (CVE-ID: CVE-2026-3558)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when processing authentication requests within the configuration of the HomeKit Accessory Protocol service. A remote attacker on the local network can bypass authentication process and gain unauthorized access to the application.


7) Heap-based buffer overflow (CVE-ID: CVE-2026-3557)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the hap_pair_verify_handler function of the hk_hap service. A remote user on the local network can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


8) Heap-based buffer overflow (CVE-ID: CVE-2026-3556)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the hk_hap_pair_storage_put function. A remote attacker on the local network can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install update from vendor's website.

References