Threat Intelligence Database

CVE-2026-3562 is a medium severity vulnerability in the Philips Hue Bridge version 1.73.1973146020. It involves improper verification of a cryptographic signature in the ed25519_sign_open function, allowing network-adjacent attackers to bypass authentication and execute arbitrary code without user interaction. The flaw is due to CWE-347: Improper Verification of Cryptographic Signature. No patch or official fix information is currently available.

CVE-2026-3561 is a heap-based buffer overflow vulnerability in the Philips Hue Bridge affecting version 1.73.1973146020. It occurs in the handling of PUT requests to the hk_hap characteristics endpoint, where insufficient validation of user-supplied data length allows overwriting a heap buffer. Although exploitation requires authentication, the authentication mechanism can be bypassed, enabling network-adjacent attackers to execute arbitrary code on the device. The vulnerability has a high severity with a CVSS score of 8. No patch or official remediation is currently documented.

CVE-2026-3560 is a heap-based buffer overflow vulnerability in the Philips Hue Bridge's HomeKit implementation, specifically in the hk_hap_pair_storage_put function. This flaw allows network-adjacent attackers to execute arbitrary code without authentication by sending specially crafted data to TCP port 8080. The vulnerability arises from improper validation of user-supplied data length before copying it to a heap buffer. It affects version 1.73.1973146020 of the Philips Hue Bridge. The CVSS score is 8.8, indicating high severity. No patch or official remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-3558 is a high-severity vulnerability in the Philips Hue Bridge version 1.73.1973146020 that allows network-adjacent attackers to bypass authentication. The flaw exists in the HomeKit Accessory Protocol service, which listens on TCP port 8080 and does not require authentication before granting access to critical functions. This missing authentication can be exploited without user interaction and can lead to unauthorized control of the device. No patch or official fix information is currently provided. There are no known exploits in the wild at this time.

CVE-2026-3557 is a heap-based buffer overflow vulnerability in the Philips Hue Bridge, specifically in the hap_pair_verify_handler function of the hk_hap service listening on TCP port 8080. This flaw allows a network-adjacent attacker to execute arbitrary code with root privileges by exploiting improper validation of user-supplied data length. Although authentication is required, the authentication mechanism can be bypassed. The vulnerability has a high severity with a CVSS score of 8. No patch or official remediation information is currently provided.