Hue Bridge EUVD-2026-12164

The CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L score of 6.3 indicates moderate severity with critical attack prerequisites: (1) AV:A requires network-adjacent access (same physical network, not internet-routable), significantly limiting exposure scope; (2) AC:L means low attack complexity once network access is achieved; (3) PR:N and UI:N mean no authentication or user interaction required; (4) S:U and impact scores (C:L/I:L/A:L) suggest limited confidentiality, integrity, and availability impact individually. However, the authentication bypass nature (ZDI-CAN-28480) is a severity multiplier—successful exploitation grants attacker the privilege level of the HAP service, enabling code execution. Real-world risk is elevated for network-adjacent threat actors (e.g., same home WiFi, nearby network) but mitigated by network segmentation. KEV/EPSS data not provided in sources; no public POC confirmed yet. Recommend prioritization based on deployment of Hue Bridge in security-sensitive networks or exposed network segments.

An attacker on the same physical network as a Philips Hue Bridge (e.g., connected to the same home WiFi, or on a network segment reachable from compromised IoT device) crafts a malicious HAP frame with a forged or absent Ed25519 signature. Due to the improper verification in ed25519_sign_open, the Bridge accepts the crafted request as authentic without validating the signature. The attacker sends a privileged command (e.g., firmware update, configuration change, or code injection via HAP extension) that would normally require valid cryptographic authentication. The Bridge executes the command, allowing the attacker arbitrary code execution with Bridge service privileges. No user interaction or prior authentication is required; the low attack complexity (AC:L) means exploitation is straightforward once network access is achieved. Real-world activation requires network adjacency—not directly exploitable from the internet unless the Bridge is exposed on a public network or the attacker gains prior network access through other means (e.g., compromised IoT device on same network).