EUVD-2026-12156Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to Philips Hue Bridge network
-
DeliveryInitiate device pairing process
-
ExploitSend crafted Zigbee ZCL frame
-
ExecutionTrigger heap buffer overflow
-
ImpactExecute arbitrary code on bridge
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must be network-adjacent to Philips Hue Bridge. User must actively initiate the device pairing process. Exploitation targets the Model Info download functionality during Zigbee ZCL frame handling without size validation. |
| Impact | Despite the high CVSS score of 8.0, the real-world risk is moderate due to significant exploitation constraints. The CVSS vector (AV:A/AC:L/PR:N/UI:R) indicates: 1) Adjacent network access required (attacker must be within Zigbee range), 2) Low attack complexity, 3) No privileges needed, but 4) User interaction required (initiating pairing). There is no EPSS data available, no KEV listing, and no public POC mentioned. Using SSVC framework: exploitation status appears to be 'none', it's not easily automatable due to user interaction requirement, though technical impact is total (code execution). This appears to be a high-CVSS-but-moderate-real-risk issue due to physical proximity and user interaction requirements. |
| Exploit ScenarioDerived | An attacker within Zigbee range (typically 10-20 meters) of a Philips Hue Bridge waits for or social engineers a user to initiate device pairing mode. During the pairing process, the attacker sends specially crafted Zigbee ZCL frames containing oversized Model Info data that overflows the heap buffer, allowing arbitrary code execution on the bridge device. This could lead to persistent backdoor access to the home network. No public POC is mentioned, but the attack requires only standard Zigbee hardware and custom frame generation capabilities. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 13, 2026
Heap-based buffer overflow vulnerability in the Philips Hue Bridge's Zigbee stack that allows network-adjacent attackers to execute arbitrary code when users initiate device pairing. The vulnerability affects all versions of Philips Hue Bridge and has a CVSS score of 8.0, requiring physical proximity and user interaction to exploit. No EPSS data or KEV listing is available, suggesting this is not actively exploited in the wild.
RemediationAI
No specific patch information or version numbers are available in the provided references. The Zero Day Initiative advisory (https://www.zerodayinitiative.com/advisories/ZDI-26-153/) should be consulted for vendor response details. As an immediate mitigation: 1) Limit physical access to areas where Hue Bridge is deployed, 2) Only initiate device pairing when necessary and with trusted devices, 3) Monitor for unexpected pairing attempts, 4) Check Philips Hue support channels for firmware updates. Contact Philips/Signify support for patch availability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the Zigbee ZCL (Zigbee Cluster Library) frame handling within the Model Info download functionality of the Philips Hue Bridge (CPE: cpe:2.3:a:philips:hue_bridge:*:*:*:*:*:*:*:*). This is a classic heap buffer overflow (CWE-122) where the application fails to validate the size of incoming data before copying it to a fixed-size heap buffer. Zigbee is a low-power wireless protocol commonly used in IoT devices, and the ZCL provides standard device behaviors and communication protocols. The flaw specifically manifests when processing custom Zigbee frames during the device pairing process.
Know when Hue Bridge gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. User interaction is required to exploit this vulnerability in that the user must initiate the device pairing process.
The specific flaw exists within the handling of custom Zigbee ZCL frames in the Model Info download functionality. The issue results from the lack of proper validation of the size of data prior to copying it to a fixed-size heap buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28276.
Zero Day Initiative Advisories
Executive ViewAI
CVE-2026-3555 is a high-severity vulnerability in Philips Hue Bridge devices that could allow attackers to gain control of smart lighting infrastructure through device pairing. While no active exploitation has been observed, organizations with Hue Bridge deployments should act now to implement mitigations since patches are not yet available.
Isolate Hue Bridge devices on a dedicated VLAN with firewall rules restricting Zigbee communication to authorized devices only; disable or password-protect the pairing mode in device settings to require physical access confirmation; implement wireless intrusion detection to monitor for suspicious Zigbee activity; establish formal change control requiring approval before adding new devices to the network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GitHub PoC
Exploit-DB