EUVD-2026-12160Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the configuration of the SRP authentication mechanism in the HomeKit Accessory Protocol service, which listens on TCP port 8080 by default. The issue results from the use of a static nonce value. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28451.
AnalysisAI
CVE-2026-3559 is an authentication bypass vulnerability in Philips Hue Bridge devices affecting the HomeKit Accessory Protocol implementation, where a static nonce in the SRP authentication mechanism allows network-adjacent attackers to gain unauthorized access without credentials. With a CVSS score of 8.1 and requiring only local network access, attackers can achieve high confidentiality and integrity impact on the affected smart home infrastructure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Philips Hue Bridge with HomeKit Accessory Protocol enabled on TCP port 8080 (default configuration). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS v3.0 score of 8.1 (High) reflects significant risk with attack vector Adjacent (AV:A), low complexity (AC:L), no privileges required (PR:N), and high impacts to confidentiality (C:H) and integrity (I:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker on the same network segment as the Hue Bridge (e.g., compromised IoT device, malicious insider, or via compromised WiFi) can connect to TCP port 8080 and exploit the static nonce to bypass SRP authentication. Since the nonce is predictable, the attacker can pre-compute valid authentication responses and gain full access to the bridge's HomeKit interface, potentially controlling all connected smart lights and accessing sensitive home automation data. … |
| Remediation | No specific patch information or fixed versions are available in the provided references. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all Philips Hue Bridge devices in use; isolate affected devices to a segmented network if possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hue Bridge
View allHeap-based buffer overflow vulnerability in Philips Hue Bridge's HomeKit implementation that allows unauthenticated netw
Critical heap-based buffer overflow vulnerability in Philips Hue Bridge's HomeKit implementation that allows network-adj
The Philips Hue Bridge HomeKit Accessory Protocol (HAP) service on TCP port 8080 lacks authentication in transient pairi
Heap-based buffer overflow vulnerability in Philips Hue Bridge devices that allows network-adjacent attackers with authe
Heap-based buffer overflow vulnerability in Philips Hue Bridge devices that allows network-adjacent attackers to execute
Heap-based buffer overflow vulnerability in the Philips Hue Bridge's Zigbee stack that allows network-adjacent attackers
Same weakness CWE-323 – Reusing a Nonce, Key Pair in Encryption
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today