The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker version 2.0.22 that is configured to listen on all network interfaces with anonymous access enabled and lacks firewall restrictions. This missing authentication for a critical function (CWE-306) allows an attacker who can access the Bridge's network to read sensitive device data and control connected lighting devices. The vulnerability has a CVSS 3.1 base score of 6.3, reflecting medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

An attacker with access to the same network as the Philips Hue Bridge Pro can exploit this vulnerability to read device data and control connected lights without authentication. This compromises confidentiality, integrity, and availability of the lighting system controlled by the Bridge.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented. Until a patch is available, restricting network access to the Bridge and isolating it from untrusted networks may reduce risk.