Hue Bridge CVE-2026-3561

Network-adjacent access to Philips Hue Bridge with exploitable authentication bypass. Attacker must reach the hk_hap characteristics endpoint and send PUT request with oversized payload exceeding heap buffer validation.

The CVSS 3.0 score of 8.0 (High) reflects significant risk with Attack Vector: Adjacent Network (AV:A), Low Attack Complexity (AC:L), Low Privileges Required (PR:L), and High impact to Confidentiality, Integrity, and Availability. However, the real-world risk appears moderate based on several factors: (1) No EPSS score indicates low observed exploitation probability, (2) Not listed in CISA KEV catalog suggesting no active exploitation, (3) Requires network-adjacent access limiting remote attacks, (4) While authentication bypass is mentioned, details are unclear. The combination of RCE capability with authentication bypass is concerning, but the adjacent network requirement significantly limits the attack surface compared to internet-facing vulnerabilities.

An attacker on the same local network as the Philips Hue Bridge (e.g., compromised device, malicious insider, or guest network access) could send specially crafted PUT requests to the HomeKit HAP characteristics endpoint. By exploiting the authentication bypass and sending oversized data in the request, they trigger a heap buffer overflow, potentially overwriting function pointers or other critical data structures to achieve code execution with device privileges. No public proof-of-concept is mentioned, but the low attack complexity suggests exploitation is straightforward for skilled attackers.