Hue Bridge CVE-2026-3558

Philips Hue Bridge with HomeKit Accessory Protocol service listening on TCP port 8080 (default configuration). Network-adjacent attacker access required. No authentication credentials needed.

The CVSS 8.1 score reflects high severity with network-adjacent access (AV:A), low attack complexity (AC:L), no privilege requirements (PR:N), and no user interaction needed (UI:N). High confidentiality and integrity impact (C:H/I:H) indicate attackers can read sensitive bridge data and modify configuration/control settings. The scope is unchanged (S:U), limiting cross-system lateral movement potential. While EPSS data was not provided in the intelligence sources, the combination of authentication bypass, moderate attack accessibility (network-adjacent rather than internet-facing), and high system impact suggests this warrants immediate prioritization, particularly for installations exposed to untrusted local networks (guest networks, shared office environments). KEV and POC status were not explicitly confirmed in the provided sources, but the ZDI reference (ZDI-26-156) and formal CVE assignment suggest active disclosure and potential public awareness. This is a genuine priority—not merely a high-CVSS scoring artifact—because authentication bypass on a smart home hub directly enables device hijacking, data exfiltration, and denial of service.

An attacker with access to the same local network as the Philips Hue Bridge (e.g., on the victim's home Wi-Fi, guest network, or corporate office network) sends unauthenticated HAP commands directly to TCP port 8080. Due to the lack of authentication checks in transient pairing mode, the bridge accepts requests to enumerate paired devices, read sensor data (motion, temperature, brightness), and execute control commands (turn lights on/off, change colors, trigger automation scenes). The attacker could remap the bridge's HomeKit setup code, create new administrative users, access location history if tracking is enabled, or disable security automations. No proof-of-concept code was explicitly mentioned in the provided intelligence, but the low attack complexity and straightforward HAP protocol make exploitation straightforward for an attacker with network access and basic protocol knowledge. This is particularly dangerous in multi-tenant or shared-network environments (apartment buildings with shared Wi-Fi, offices with guest networks, or environments where untrusted users have network access).