EUVD-2026-58240
GHSA-43qc-c2gq-5fq2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:A because exploitation is bounded to local network adjacency; PR:N because the MQTT broker accepts anonymous connections by firmware default with no credential requirement.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker (v2.0.22) that listens on all network interfaces with anonymous access enabled and no firewall restriction. An attacker with access to the Bridge's network can read device data and control connected lights.
AnalysisAI
Unauthenticated MQTT access on Philips Hue Bridge Pro exposes all connected Zigbee lighting devices to any attacker sharing the same network segment. The firmware ships Mosquitto MQTT broker v2.0.22 with anonymous access enabled and no interface binding restriction, meaning no credentials are needed to subscribe to device telemetry topics or publish commands that toggle, dim, or cycle lights. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be on the same LAN segment, VLAN, or Wi-Fi network as the Hue Bridge Pro - CVSS AV:A confirms this adjacency prerequisite, and internet-based direct exploitation is not possible without a prior pivot onto the local network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.3 score with AV:A appropriately constrains risk to attackers already on the same LAN or Wi-Fi segment - internet-originated exploitation is not directly possible without a prior foothold on the local network. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sharing the same Wi-Fi network as the Hue Bridge Pro - such as a guest on a shared network or an operator of a compromised IoT device - uses a standard MQTT client (e.g., mosquitto_sub) to connect anonymously on TCP port 1883 without any credentials. The attacker subscribes to all topics using the wildcard '#' to harvest real-time device state, then publishes crafted payloads to light-control topics to toggle, dim, or cycle connected Zigbee luminaires. … |
| Remediation | The primary fix is to apply any firmware update released by Signify that disables anonymous MQTT access or restricts the broker to loopback-only binding. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today