What is the CVSS score of CVE-2026-3557?

CVE-2026-3557 has a CVSS 3.0 base score of 8.0 (High). CVSS vector: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Hue Bridge are affected by CVE-2026-3557?

CVE-2026-3557 is a critical remote code execution vulnerability affecting Philips Hue Bridge devices that could allow attackers to gain complete control of smart home infrastructure and connected…

How to fix or mitigate CVE-2026-3557?

Within 24 hours: Inventory all Philips Hue Bridge deployments and document network connectivity; isolate affected devices to a dedicated VLAN if possible. Within 7 days: Implement network access controls restricting TCP port 8080 to authorized users only; disable HomeKit Accessory Protocol if not actively required; establish monitoring for suspicious activity on port 8080. Within 30 days: Maintain continuous vendor communication for patch availability; evaluate alternative smart home platforms with stronger security postures; conduct penetration testing on network segments housing Hue Bridge devices once compensating controls are in place.

Hue Bridge CVE-2026-3557

EUVD-2026-12158 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-03-13 zdi

Buffer Overflow RCE Heap Overflow Hue Bridge

8.0

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 14:52 vuln.today

cvss_changed

EUVD ID Assigned

Mar 13, 2026 - 21:01 euvd

EUVD-2026-12158

Analysis Generated

Mar 13, 2026 - 21:01 vuln.today

CVE Published

Mar 13, 2026 - 20:36 nvd

HIGH 8.0

DescriptionCVE.org

Philips Hue Bridge hap_pair_verify_handler Sub-TLV Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the hap_pair_verify_handler function of the hk_hap service, which listens on TCP port 8080 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28337.

AnalysisAI

Heap-based buffer overflow vulnerability in Philips Hue Bridge devices that allows network-adjacent attackers with authentication (which can be bypassed) to achieve remote code execution as root. The vulnerability affects the HomeKit Accessory Protocol (HAP) implementation on TCP port 8080 and has a high CVSS score of 8.0, though no active exploitation or public PoC has been reported.

Technical ContextAI

The vulnerability exists in the hap_pair_verify_handler function within the hk_hap service, which implements Apple's HomeKit Accessory Protocol for smart home integration. According to the CPE data (cpe:2.3:a:philips:hue_bridge:*:*:*:*:*:*:*:*), all versions of Philips Hue Bridge are affected. This is a classic heap buffer overflow (CWE-122) where the application fails to validate the length of user-supplied Sub-TLV (Type-Length-Value) data before copying it to a heap buffer, allowing memory corruption and arbitrary code execution.

RemediationAI

No patch information or fixed versions are available in the provided references. The only reference is to the Zero Day Initiative advisory (ZDI-26-155) which may contain additional details but is not accessible in this data. Organizations should monitor Philips security advisories for patches, consider network segmentation to limit adjacent network access to Hue Bridges, and potentially disable HomeKit integration if not required until a patch is available.