Philips Hue Bridge Pro
Monthly
Unauthenticated MQTT access on Philips Hue Bridge Pro exposes all connected Zigbee lighting devices to any attacker sharing the same network segment. The firmware ships Mosquitto MQTT broker v2.0.22 with anonymous access enabled and no interface binding restriction, meaning no credentials are needed to subscribe to device telemetry topics or publish commands that toggle, dim, or cycle lights. No public exploit code has been identified at time of analysis; however, CISA is tracking this vulnerability via CSAF advisory va-26-225-01, indicating active government-level monitoring.
Unauthenticated MQTT access on Philips Hue Bridge Pro exposes all connected Zigbee lighting devices to any attacker sharing the same network segment. The firmware ships Mosquitto MQTT broker v2.0.22 with anonymous access enabled and no interface binding restriction, meaning no credentials are needed to subscribe to device telemetry topics or publish commands that toggle, dim, or cycle lights. No public exploit code has been identified at time of analysis; however, CISA is tracking this vulnerability via CSAF advisory va-26-225-01, indicating active government-level monitoring.