CVE-2026-118631 · Infrastructure
NO FIX YET
The factory data service on the Philips Hue Bridge Pro passes a user-supplied string into a system call without validating it. A local attacker who already runs low-privileged code in a container on the bridge can modify files as the service account.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
The flaw is in the factory data service on TCP port 5001 of the Philips Hue Bridge Pro, and the attacker must first hold low-privileged code execution inside a container on the same device. Only Hue Bridge Pro installations are in scope, and an attacker without a foothold in that container cannot reach the service through this flaw. unknown
Not affected if no-container-foothold
Who cares hue-bridge-pro, iot, philips-hue
Unknown from the sources.
No fix yet, per the sources.
Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability. This vulnerability allows local attackers to modify files on affected installations of Philips Hue Bridge Pro. An attacker must first obtain the ability to execute low-privileged code within a container on the target system, in order to exploit this vulnerability.
The specific flaw exists within the factory data service, which listens on TCP port 5001 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to modify files in the context of the service account. Was ZDI-CAN-33090.
This page as .md · .json · CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.