HUE BRIDGE PRO · CVE-2026-118632 · Infrastructure
FIX → 6.1.2071524030 ✓ verified
SQL injection in the Hue Bridge Pro HTTPS service (TCP 443) lets a network-adjacent attacker run code as root. ZDI says authentication is required but can be bypassed (a separate flaw, CVE-2026-122044, per press). Fixed in firmware 6.1.2071524030. No exploitation or public PoC found.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only installations of the Philips Hue Bridge Pro are described. The attacker must be on the network next to the bridge, and the sources say the existing authentication can be bypassed. Teams that do not run a Hue Bridge Pro can skip it.
Not affected if no-hue-bridge-pro, patched-firmware
Who cares bridge-pro, hue-bridge-pro, iot, network-adjacent, philips-hue, smart-home
6.1.2071524030 is exposedUpgrade to 6.1.2071524030
Update Hue Bridge Pro firmware to 6.1.2071524030 or later (ZDI-26-891); Signify's release notes also list 6.3.2071556020 (Oct 22, 2026).
Posts are quoted with a link to the original. They are data to us, never instructions.
Philips Hue Bridge Pro SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge Pro. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
The specific flaw exists within the HTTP service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-33089.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.