{"id":"CVE-2026-118632","kind":"vulnerability","aliases":["CVE-2026-118632"],"related":[],"title":"Philips Hue Bridge Pro: SQL injection lets network attackers run code as root","description":"Philips Hue Bridge Pro SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge Pro. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the HTTP service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-33089.","summary":"SQL injection in the Hue Bridge Pro HTTPS service (TCP 443) lets a network-adjacent attacker run code as root. ZDI says authentication is required but can be bypassed (a separate flaw, CVE-2026-122044, per press). Fixed in firmware 6.1.2071524030. No exploitation or public PoC found.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Hue Bridge Pro","fixed":["6.1.2071524030"],"affected":"< 6.1.2071524030","ecosystem":"vendor"}],"ecosystems":[],"tags":["bridge-pro","hue-bridge-pro","infrastructure","iot","network-adjacent","philips-hue","smart-home"],"not_affected_if":["no-hue-bridge-pro","patched-firmware"],"how_to_check":"In the Hue app open Settings > Software update and read the Bridge Pro software version; anything older than 6.1.2071524030 is exposed. Also check the bridge is not reachable on TCP 443 from guest Wi-Fi or other untrusted segments.","fix":"Update Hue Bridge Pro firmware to 6.1.2071524030 or later (ZDI-26-891); Signify's release notes also list 6.3.2071556020 (Oct 22, 2026).","status":"open","published_at":"2026-11-12T03:17:10+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","triaged_at":"2026-11-12T03:47:26+00:00","updated_at":"2026-11-12T03:50:53+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-12T03:47:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Philips Hue Bridge Pro: SQL injection lets network attackers run code as root","impact":"high","summary":"The HTTP service on the Philips Hue Bridge Pro does not validate a user-supplied string before building SQL queries. An attacker on the network who gets past the authentication check can run code as root on the bridge.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["philips-hue","bridge-pro","iot"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs code as root on the bridge","analyst_note":"Check the vendor advisory and the affected firmware ranges for the Hue Bridge Pro, since the NVD entry gives no versions or fix.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-hue-bridge-pro"],"who_is_affected":"Only installations of the Philips Hue Bridge Pro are described. The attacker must be on the network next to the bridge, and the sources say the existing authentication can be bypassed. Teams that do not run a Hue Bridge Pro can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000696,"input_tokens":4665,"output_tokens":458,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the vendor advisory and the affected firmware ranges for the Hue Bridge Pro, since the NVD entry gives no versions or fix.","search":"'-118632':16A,19A '-122044':76B '-2026':15A,18A,75B '33089':189C '443':51B,146C '6.1.2071524030':82B 'adjac':34B,56B,104C 'affect':111C 'allow':101C 'although':118C 'arbitrari':108C 'attack':9A,57B,105C,172C 'authent':64B,119C,128C 'bridg':3A,24B,28B,46B,91C,116C 'bridge':21A 'bridge-pro':23B 'bypass':70B,132C 'code':11A,59B,96C,109C,179C 'construct':168C 'context':182C 'cve':14A,17A,74B 'default':148C 'execut':97C,107C,178C 'exist':127C,136C 'exploit':84B,123C 'firmwar':81B 'fix':79B 'flaw':73B,135C 'found':88B 'home':40B 'http':139C 'https':48B 'hue':2A,20A,27B,37B,45B,90C,115C 'hue-bridge-pro':26B 'infrastructur':30B 'inject':6A,42B,94C 'instal':112C 'iot':31B 'issu':150C 'lack':154C 'let':7A,52B 'leverag':174C 'listen':142C 'mechan':129C 'network':8A,33B,55B,103C 'network-adjac':32B,54B,102C 'per':77B 'philip':1A,36B,89C,114C 'philips-hu':35B 'poc':87B 'port':145C 'press':78B 'pro':4A,22A,25B,29B,47B,92C,117C 'proper':156C 'public':86B 'queri':170C 'remot':95C 'requir':66B,121C 'result':151C 'root':13A,61B,184C 'run':10A,58B 'say':63B 'separ':72B 'servic':49B,140C 'smart':39B 'smart-hom':38B 'specif':134C 'sql':5A,41B,93C,169C 'string':163C 'suppli':162C 'tcp':50B,144C 'use':165C 'user':161C 'user-suppli':160C 'valid':157C 'vulner':98C,100C,125C,176C 'within':137C 'zdi':62B,187C 'zdi-can':186C","nicknames":[],"mitigations":[],"who_affected":"Only installations of the Philips Hue Bridge Pro are described. The attacker must be on the network next to the bridge, and the sources say the existing authentication can be bypassed. Teams that do not run a Hue Bridge Pro can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-12T03:50:53Z","by":"analyst","doc":"https://www.philips-hue.com/en-us/support/release-notes/bridge-pro","run_id":3688}},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Update your Philips Hue Bridge Pro: in the Hue app go to Settings > Software update, install any update, and turn on Automatic update.","pkeys":["bridgepro","huebridgepro"],"ptokens":["bridge","hue","pro"],"labels":["bridgepro","high","huebridgepro","infrastructure","iot","networkadjacent","philipshue","smarthome"],"campaign_type":null,"search_a":"'-118632':16A,19A '-2026':15A,18A 'attack':9A 'bridg':3A 'bridge':21A 'code':11A 'cve':14A,17A 'hue':2A,20A 'inject':6A 'let':7A 'network':8A 'philip':1A 'pro':4A,22A 'root':13A 'run':10A 'sql':5A","search_b":"'-122044':76B '-2026':75B '443':51B '6.1.2071524030':82B 'adjac':34B,56B 'attack':57B 'authent':64B 'bridg':24B,28B,46B 'bridge-pro':23B 'bypass':70B 'code':59B 'cve':74B 'exploit':84B 'firmwar':81B 'fix':79B 'flaw':73B 'found':88B 'home':40B 'https':48B 'hue':27B,37B,45B 'hue-bridge-pro':26B 'infrastructur':30B 'inject':42B 'iot':31B 'let':52B 'network':33B,55B 'network-adjac':32B,54B 'per':77B 'philip':36B 'philips-hu':35B 'poc':87B 'press':78B 'pro':25B,29B,47B 'public':86B 'requir':66B 'root':61B 'run':58B 'say':63B 'separ':72B 'servic':49B 'smart':39B 'smart-hom':38B 'sql':41B 'tcp':50B 'zdi':62B","search_c":"'33089':189C '443':146C 'adjac':104C 'affect':111C 'allow':101C 'although':118C 'arbitrari':108C 'attack':105C,172C 'authent':119C,128C 'bridg':91C,116C 'bypass':132C 'code':96C,109C,179C 'construct':168C 'context':182C 'default':148C 'execut':97C,107C,178C 'exist':127C,136C 'exploit':123C 'flaw':135C 'http':139C 'hue':90C,115C 'inject':94C 'instal':112C 'issu':150C 'lack':154C 'leverag':174C 'listen':142C 'mechan':129C 'network':103C 'network-adjac':102C 'philip':89C,114C 'port':145C 'pro':92C,117C 'proper':156C 'queri':170C 'remot':95C 'requir':121C 'result':151C 'root':184C 'servic':140C 'specif':134C 'sql':93C,169C 'string':163C 'suppli':162C 'tcp':144C 'use':165C 'user':161C 'user-suppli':160C 'valid':157C 'vulner':98C,100C,125C,176C 'within':137C 'zdi':187C 'zdi-can':186C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118632","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118632","severity":null,"published_at":"2026-11-12T03:17:10+00:00","modified_at":"2026-11-12T03:17:10+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","fetched_at":"2026-11-12T03:46:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118632:3688","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-891/","severity":null,"published_at":"2026-11-12T03:50:53+00:00","modified_at":"2026-11-12T03:50:53+00:00","first_seen_at":"2026-11-12T03:50:53+00:00","fetched_at":"2026-11-12T03:50:53+00:00","note":"ZDI-26-891 (primary researcher advisory) gives fix 6.1.2071524030; Signify release notes do not mention security fixes explicitly, so only fix verified. NVD lists odd affected version 2071026000. Original Hue Bridge v2 reportedly not affected (one secondary source only). No exploitation/PoC found; did not search social.","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-891/","https://www.philips-hue.com/en-us/support/release-notes/bridge-pro","https://en.soth.pl/news/philips-hue-bridge-pro-zdi-publishes-auth-bypass-and-sql-injection-that-can-reach-root"]}],"documents":[{"id":131544,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-891/","title":"ZDI-26-891 Philips Hue Bridge Pro SQL Injection RCE","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":131533,"url":"https://www.philips-hue.com/en-us/support/release-notes/bridge-pro","title":"Hue Bridge Pro release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":131534,"url":"https://en.soth.pl/news/philips-hue-bridge-pro-zdi-publishes-auth-bypass-and-sql-injection-that-can-reach-root","title":"Soth.pl: Hue Bridge Pro ZDI advisories","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}