Hue Bridge CVE-2026-3559

Philips Hue Bridge with HomeKit Accessory Protocol enabled on TCP port 8080 (default configuration). Network adjacency required. No authentication credentials needed.

The CVSS v3.0 score of 8.1 (High) reflects significant risk with attack vector Adjacent (AV:A), low complexity (AC:L), no privileges required (PR:N), and high impacts to confidentiality (C:H) and integrity (I:H). However, the Adjacent network requirement limits exposure compared to remote vulnerabilities. Without EPSS data, KEV listing, or known POCs, this appears to be a disclosed but not actively exploited vulnerability. The SSVC framework would classify this as requiring attention due to: automatable exploitation (static nonce), significant technical impact (full authentication bypass), but limited by adjacent network access. This is a priority for organizations with Hue Bridge deployments but not a critical internet-facing emergency.

An attacker on the same network segment as the Hue Bridge (e.g., compromised IoT device, malicious insider, or via compromised WiFi) can connect to TCP port 8080 and exploit the static nonce to bypass SRP authentication. Since the nonce is predictable, the attacker can pre-compute valid authentication responses and gain full access to the bridge's HomeKit interface, potentially controlling all connected smart lights and accessing sensitive home automation data. The low attack complexity means this could be automated in malware targeting smart home networks.