{"id":"CVE-2026-118631","kind":"vulnerability","aliases":["CVE-2026-118631"],"related":[],"title":"Philips Hue Bridge Pro: local container user can modify files","description":"Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability. This vulnerability allows local attackers to modify files on affected installations of Philips Hue Bridge Pro. An attacker must first obtain the ability to execute low-privileged code within a container on the target system, in order to exploit this vulnerability.\n\nThe specific flaw exists within the factory data service, which listens on TCP port 5001 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to modify files in the context of the service account. Was ZDI-CAN-33090.","summary":"The factory data service on the Philips Hue Bridge Pro passes a user-supplied string into a system call without validating it. A local attacker who already runs low-privileged code in a container on the bridge can modify files as the service account.","severity":"low","cvss":3.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hue-bridge-pro","infrastructure","iot","philips-hue"],"not_affected_if":["no-container-foothold"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-12T03:17:10+00:00","first_seen_at":"2026-11-12T03:46:12+00:00","triaged_at":"2026-11-12T03:47:48+00:00","updated_at":"2026-11-12T03:47:48+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-12T03:47:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Philips Hue Bridge Pro: local container user can modify files","impact":"medium","summary":"The factory data service on the Philips Hue Bridge Pro passes a user-supplied string into a system call without validating it. A local attacker who already runs low-privileged code in a container on the bridge can modify files as the service account.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["philips-hue","hue-bridge-pro","iot"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker modifies files as the bridge service account","analyst_note":"Find the vendor advisory or ZDI advisory for ZDI-CAN-33090 to confirm affected firmware versions and any fix.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-container-foothold"],"who_is_affected":"The flaw is in the factory data service on TCP port 5001 of the Philips Hue Bridge Pro, and the attacker must first hold low-privileged code execution inside a container on the same device. Only Hue Bridge Pro installations are in scope, and an attacker without a foothold in that container cannot reach the service through this flaw. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000707,"input_tokens":4660,"output_tokens":481,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-118631':13A,16A '-2026':12A,15A '33090':184C '5001':138C 'abil':104C 'account':71B,179C 'affect':91C 'allow':84C 'alreadi':53B 'argument':76C 'attack':51B,86C,99C,165C 'bridg':3A,19B,34B,64B,74C,96C 'call':45B,163C 'code':58B,110C 'contain':6A,61B,113C 'context':175C 'cve':11A,14A 'data':28B,131C 'default':140C 'execut':106C,160C 'exist':127C 'exploit':121C 'factori':27B,130C 'file':10A,67B,79C,89C,172C 'first':101C 'flaw':126C 'hue':2A,18B,25B,33B,73C,95C 'hue-bridge-pro':17B 'infrastructur':21B 'inject':77C 'instal':92C 'iot':22B 'issu':142C 'lack':146C 'leverag':167C 'listen':134C 'local':5A,50B,85C 'low':56B,108C 'low-privileg':55B,107C 'modifi':9A,66B,88C,171C 'must':100C 'obtain':102C 'order':119C 'pass':36B 'philip':1A,24B,32B,72C,94C 'philips-hu':23B 'port':137C 'privileg':57B,109C 'pro':4A,20B,35B,75C,97C 'proper':148C 'restrict':78C 'result':143C 'run':54B 'servic':29B,70B,132C,178C 'specif':125C 'string':41B,155C 'suppli':40B,154C 'system':44B,117C,162C 'target':116C 'tcp':136C 'use':157C 'user':7A,39B,153C 'user-suppli':38B,152C 'valid':47B,149C 'vulner':81C,83C,123C,169C 'within':111C,128C 'without':46B 'write':80C 'zdi':182C 'zdi-can':181C","nicknames":[],"mitigations":[],"who_affected":"The flaw is in the factory data service on TCP port 5001 of the Philips Hue Bridge Pro, and the attacker must first hold low-privileged code execution inside a container on the same device. Only Hue Bridge Pro installations are in scope, and an attacker without a foothold in that container cannot reach the service through this flaw. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["huebridgepro","infrastructure","iot","low","philipshue"],"campaign_type":null,"search_a":"'-118631':13A,16A '-2026':12A,15A 'bridg':3A 'contain':6A 'cve':11A,14A 'file':10A 'hue':2A 'local':5A 'modifi':9A 'philip':1A 'pro':4A 'user':7A","search_b":"'account':71B 'alreadi':53B 'attack':51B 'bridg':19B,34B,64B 'call':45B 'code':58B 'contain':61B 'data':28B 'factori':27B 'file':67B 'hue':18B,25B,33B 'hue-bridge-pro':17B 'infrastructur':21B 'iot':22B 'local':50B 'low':56B 'low-privileg':55B 'modifi':66B 'pass':36B 'philip':24B,32B 'philips-hu':23B 'privileg':57B 'pro':20B,35B 'run':54B 'servic':29B,70B 'string':41B 'suppli':40B 'system':44B 'user':39B 'user-suppli':38B 'valid':47B 'without':46B","search_c":"'33090':184C '5001':138C 'abil':104C 'account':179C 'affect':91C 'allow':84C 'argument':76C 'attack':86C,99C,165C 'bridg':74C,96C 'call':163C 'code':110C 'contain':113C 'context':175C 'data':131C 'default':140C 'execut':106C,160C 'exist':127C 'exploit':121C 'factori':130C 'file':79C,89C,172C 'first':101C 'flaw':126C 'hue':73C,95C 'inject':77C 'instal':92C 'issu':142C 'lack':146C 'leverag':167C 'listen':134C 'local':85C 'low':108C 'low-privileg':107C 'modifi':88C,171C 'must':100C 'obtain':102C 'order':119C 'philip':72C,94C 'port':137C 'privileg':109C 'pro':75C,97C 'proper':148C 'restrict':78C 'result':143C 'servic':132C,178C 'specif':125C 'string':155C 'suppli':154C 'system':117C,162C 'target':116C 'tcp':136C 'use':157C 'user':153C 'user-suppli':152C 'valid':149C 'vulner':81C,83C,123C,169C 'within':111C,128C 'write':80C 'zdi':182C 'zdi-can':181C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118631","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118631","severity":null,"published_at":"2026-11-12T03:17:10+00:00","modified_at":"2026-11-12T03:17:10+00:00","first_seen_at":"2026-11-12T03:46:12+00:00","fetched_at":"2026-11-12T03:46:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}