What is the CVSS score of CVE-2026-3559?

CVE-2026-3559 has a CVSS 3.0 base score of 8.1 (High). CVSS vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Hue Bridge are affected by CVE-2026-3559?

CVE-2026-3559 affects Philips Hue Bridge smart home devices, allowing attackers on the local network to bypass authentication and gain unauthorized control without credentials.

How to fix or mitigate CVE-2026-3559?

Within 24 hours: Identify and inventory all Philips Hue Bridge devices in use; isolate affected devices to a segmented network if possible. Within 7 days: Implement network access controls restricting Hue Bridge communication to trusted devices only; disable HomeKit integration if not critical to operations; monitor for suspicious local network activity. Within 30 days: Establish a vendor communication channel with Philips for patch availability; evaluate alternative smart home platforms with stronger security postures; conduct access reviews on all systems that may have been compromised.

Hue Bridge CVE-2026-3559

EUVD-2026-12160 HIGH

Reusing a Nonce, Key Pair in Encryption (CWE-323)

2026-03-13 zdi

Authentication Bypass Hue Bridge Philips

8.1

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 14:52 vuln.today

cvss_changed

EUVD ID Assigned

Mar 13, 2026 - 21:01 euvd

EUVD-2026-12160

Analysis Generated

Mar 13, 2026 - 21:01 vuln.today

CVE Published

Mar 13, 2026 - 20:36 nvd

HIGH 8.1

DescriptionCVE.org

Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the configuration of the SRP authentication mechanism in the HomeKit Accessory Protocol service, which listens on TCP port 8080 by default. The issue results from the use of a static nonce value. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28451.

AnalysisAI

CVE-2026-3559 is an authentication bypass vulnerability in Philips Hue Bridge devices affecting the HomeKit Accessory Protocol implementation, where a static nonce in the SRP authentication mechanism allows network-adjacent attackers to gain unauthorized access without credentials. With a CVSS score of 8.1 and requiring only local network access, attackers can achieve high confidentiality and integrity impact on the affected smart home infrastructure. No active exploitation (not in KEV), POC availability, or EPSS data is currently available.

Technical ContextAI

The vulnerability affects Philips Hue Bridge devices (CPE: cpe:2.3:a:philips:hue_bridge:*:*:*:*:*:*:*:*) running the HomeKit Accessory Protocol (HAP) service on TCP port 8080. The flaw stems from CWE-323 (Reusing a Nonce, Key Pair in Encryption), specifically in the Secure Remote Password (SRP) authentication mechanism implementation. SRP is designed to provide zero-knowledge proof authentication, but the use of a static nonce completely undermines this security by making the authentication challenge predictable and replayable. This affects all versions of the Hue Bridge firmware as indicated by the wildcard CPE notation.

RemediationAI

No specific patch information or fixed versions are available in the provided references. The Zero Day Initiative advisory (https://www.zerodayinitiative.com/advisories/ZDI-26-157/) should be consulted for vendor response and patch availability. As an immediate mitigation, network segmentation should be implemented to restrict access to TCP port 8080 on affected Hue Bridge devices to trusted devices only. Consider disabling HomeKit integration if not required, or implementing additional network-layer authentication controls until a vendor patch is available.