A SQL Injection vulnerability in the Philips Hue Bridge Pro allows network-adjacent attackers to execute arbitrary code with root privileges. Exploitation requires authentication, but the authentication mechanism can be bypassed. The flaw is in the HTTP service on TCP port 443 due to improper validation of user input used in SQL queries.