What is the CVSS score of CVE-2026-3558?

CVE-2026-3558 has a CVSS 3.0 base score of 8.1 (High). CVSS vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Hue Bridge are affected by CVE-2026-3558?

Philips Hue Bridge smart lighting systems are vulnerable to authentication bypass attacks from network-adjacent threats, potentially allowing unauthorized control of building lighting infrastructure…

How to fix or mitigate CVE-2026-3558?

Within 24 hours: Identify all Philips Hue Bridge devices in your environment and document their network locations; assess whether they control critical facility lighting. Within 7 days: Implement network segmentation to isolate Hue Bridge devices from general corporate networks and restrict access to port 8080; disable HomeKit pairing mode if not actively used. Within 30 days: Evaluate replacement or upgrade timeline for affected devices; monitor Philips security advisories for patch availability; consider alternative smart lighting solutions with stronger authentication mechanisms.

Hue Bridge CVE-2026-3558

EUVD-2026-12159 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-03-13 zdi

Authentication Bypass Hue Bridge Philips

8.1

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 14:52 vuln.today

cvss_changed

EUVD ID Assigned

Mar 13, 2026 - 21:01 euvd

EUVD-2026-12159

Analysis Generated

Mar 13, 2026 - 21:01 vuln.today

CVE Published

Mar 13, 2026 - 20:36 nvd

HIGH 8.1

DescriptionCVE.org

Philips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the configuration of the HomeKit Accessory Protocol service, which listens on TCP port 8080 by default. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28374.

AnalysisAI

The Philips Hue Bridge HomeKit Accessory Protocol (HAP) service on TCP port 8080 lacks authentication in transient pairing mode, allowing network-adjacent attackers to bypass authentication and gain unauthorized access without requiring credentials (CVE-2026-3558, CVSS 8.1). This vulnerability affects all versions of Philips Hue Bridge and has been tracked as ZDI-CAN-28374. Real-world risk is elevated due to the low attack complexity, network-adjacent accessibility, and high impact on confidentiality and integrity of the smart lighting system.

Technical ContextAI

The Philips Hue Bridge implements Apple's HomeKit Accessory Protocol (HAP), a standardized protocol for secure communication with HomeKit-enabled smart home devices. The vulnerability exists in the HAP service configuration listening on TCP port 8080, which is designed to allow device pairing and control. The root cause is classified under CWE-306 (Missing Authentication Check), indicating that the service fails to enforce authentication mechanisms before granting access to sensitive functionality during transient pairing mode. HAP typically requires authentication via setup codes or previously paired device credentials; however, this implementation appears to accept commands without validating the requester's authentication status, potentially allowing unauthorized configuration changes, data access, or device manipulation. The 'network-adjacent' attack vector indicates the attacker must be on the same local network segment as the Hue Bridge, but no additional privileges or user interaction are required.

RemediationAI

Firmware Update: Check Philips Hue Bridge support pages and the ZDI advisory (https://www.zerodayinitiative.com/advisories/ZDI-26-156/) for available security patches. Apply the latest firmware version that addresses CWE-306 authentication bypass. 2. Network Segmentation Mitigation (interim): Isolate the Hue Bridge to a trusted network segment; restrict access to TCP port 8080 via firewall rules to known trusted devices only. Disable guest network access to the bridge's network segment if feasible. 3. Pairing Mode Management: Exit transient pairing mode immediately after legitimate devices are paired; avoid leaving the bridge in pairing mode for extended periods. 4. Access Controls: If the bridge supports authentication configuration, ensure all available security options (setup codes, HomeKit authentication) are enforced. 5. Monitoring: Monitor TCP port 8080 traffic for suspicious access patterns or unauthorized configuration requests.