---
id: "CVE-2026-118631"
page: "https://infrastack.ai/live/CVE-2026-118631"
kind: "vulnerability"
aliases: ["CVE-2026-118631"]
title: "Philips Hue Bridge Pro: local container user can modify files"
severity: "low"
cvss: 3.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["hue-bridge-pro", "infrastructure", "iot", "philips-hue"]
not_affected_if: ["no-container-foothold"]
published_at: "2026-11-12T03:17:10+00:00"
first_seen_at: "2026-11-12T03:46:12+00:00"
updated_at: "2026-11-12T03:47:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118631", "first_seen_at": "2026-11-12T03:46:12+00:00"}]
exploit_sources: []
---

# Philips Hue Bridge Pro: local container user can modify files

Link for people: https://infrastack.ai/live/CVE-2026-118631 (this .md is for agents)

The factory data service on the Philips Hue Bridge Pro passes a user-supplied string into a system call without validating it. A local attacker who already runs low-privileged code in a container on the bridge can modify files as the service account.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-12T03:46:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118631

## From the sources

Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability. This vulnerability allows local attackers to modify files on affected installations of Philips Hue Bridge Pro. An attacker must first obtain the ability to execute low-privileged code within a container on the target system, in order to exploit this vulnerability.

The specific flaw exists within the factory data service, which listens on TCP port 5001 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to modify files in the context of the service account. Was ZDI-CAN-33090.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_