Hue Bridge EUVD-2026-12157

Network-adjacent attacker on same local network segment as Philips Hue Bridge. HomeKit Pair-Setup service must be accessible. No authentication required. Default installations vulnerable.

The CVSS 3.0 score of 8.8 reflects high severity with attack vector 'Adjacent' (AV:A), low complexity (AC:L), no privileges required (PR:N), and high impact across confidentiality, integrity, and availability. However, the real-world risk requires nuanced assessment: the attack requires local network access, limiting exposure compared to internet-facing vulnerabilities. No EPSS score is provided, and the vulnerability is not listed in CISA KEV, suggesting no known active exploitation. The ZDI advisory (ZDI-26-154) indicates this was responsibly disclosed. While the technical impact is severe (unauthenticated RCE), the adjacent network requirement significantly constrains the attack surface to trusted network environments. This is a priority for organizations with Philips Hue deployments but not a critical internet-wide threat.

An attacker on the same local network as the Philips Hue Bridge (e.g., compromised IoT device, malicious insider, or attacker on guest WiFi with access to the IoT VLAN) could send specially crafted HomeKit pair-setup requests to trigger the buffer overflow. Since no authentication is required and attack complexity is low, the attacker could potentially automate this attack. Successful exploitation would grant code execution with the privileges of the HomeKit service, potentially allowing full control over the home automation system, access to other network devices, or using the bridge as a persistent foothold in the network. No public proof-of-concept is mentioned, but the detailed function name suggests the vulnerability details are well understood.