EUVD-2026-12161Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious HomeKit pairing request
-
ExploitSend to TCP port 8080
-
ExecutionTrigger buffer overflow in hk_hap_pair_storage_put
-
ImpactExecute arbitrary code on bridge
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Philips Hue Bridge with HomeKit implementation enabled and listening on TCP port 8080 (default). Network-adjacent access required. No authentication needed. |
| Impact | The CVSS 8.8 score indicates high severity due to adjacent network access (AV:A), low complexity (AC:L), no authentication required (PR:N), and high impact across confidentiality, integrity, and availability. However, the adjacent network requirement significantly limits the attack surface compared to remote vulnerabilities. No EPSS data suggests exploitation likelihood hasn't been measured. The vulnerability is not in CISA's KEV catalog, indicating no known active exploitation. Without a public POC and given the local network access requirement, this represents a moderate real-world risk primarily in environments where untrusted devices share the same network segment as Hue Bridges. |
| Exploit ScenarioDerived | An attacker on the same network segment as the Hue Bridge (e.g., compromised IoT device, malicious insider, or guest network spillover) sends specially crafted HomeKit protocol messages to TCP port 8080. The malformed data triggers the heap overflow in hk_hap_pair_storage_put, allowing the attacker to overwrite memory structures and execute arbitrary code on the device. This could lead to persistent backdoor installation, smart home manipulation, or lateral movement into the home network. No authentication is required, making any adjacent network access sufficient for exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 13, 2026
Heap-based buffer overflow vulnerability in Philips Hue Bridge's HomeKit implementation that allows unauthenticated network-adjacent attackers to execute arbitrary code. The vulnerability affects all versions of Philips Hue Bridge (CPE indicates no version restrictions) through the hk_hap_pair_storage_put function on TCP port 8080. No EPSS data or KEV listing is available, and while ZDI has published an advisory, no public POC or active exploitation has been reported.
RemediationAI
No patch information or vendor advisory is currently available beyond the ZDI advisory (ZDI-26-158). As immediate mitigation, network segmentation should be implemented to isolate Hue Bridge devices from untrusted network segments. Consider disabling HomeKit integration if not required, or implement firewall rules to restrict access to TCP port 8080 to trusted devices only. Monitor Philips/Signify security advisories for firmware updates addressing this vulnerability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the HomeKit Accessory Protocol (HAP) implementation within Philips Hue Bridge devices (cpe:2.3:a:philips:hue_bridge:*:*:*:*:*:*:*:*). HomeKit is Apple's smart home framework, and the Hue Bridge integrates with it via TCP port 8080. The flaw is a classic heap buffer overflow (CWE-122) where the hk_hap_pair_storage_put function fails to validate the length of user-supplied data before copying it to a heap buffer. This allows attackers to overwrite adjacent memory structures and potentially hijack program execution flow.
Know when Hue Bridge gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Philips Hue Bridge HomeKit hk_hap_pair_storage_put Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the hk_hap_pair_storage_put function of the HomeKit implementation, which listens on TCP port 8080 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28469.
Zero Day Initiative Advisories
Executive ViewAI
CVE-2026-3560 is a critical remote code execution vulnerability affecting all Philips Hue Bridge devices, allowing attackers on the same network to take complete control without authentication. This poses a significant risk to organizations using smart lighting infrastructure, potentially compromising network security and enabling lateral movement into connected systems.
Segment Philips Hue Bridge devices to an isolated VLAN with no direct access from general networks. Restrict inbound TCP port 8080 access via firewall rules to authorized management systems only. Deploy IDS/IPS signatures to detect exploitation attempts. Consider disabling HomeKit functionality if not critical to operations. Monitor for suspicious HomeKit pairing requests and network anomalies. Patch immediately upon vendor release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GitHub PoC
Exploit-DB