---
id: "CVE-2026-118632"
page: "https://infrastack.ai/live/CVE-2026-118632"
kind: "vulnerability"
aliases: ["CVE-2026-118632"]
title: "Philips Hue Bridge Pro: SQL injection lets network attackers run code as root"
severity: "high"
cvss: 8.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Hue Bridge Pro", "fixed": ["6.1.2071524030"], "affected": "< 6.1.2071524030", "ecosystem": "vendor"}]
ecosystems: []
tags: ["bridge-pro", "hue-bridge-pro", "infrastructure", "iot", "network-adjacent", "philips-hue", "smart-home"]
not_affected_if: ["no-hue-bridge-pro", "patched-firmware"]
published_at: "2026-11-12T03:17:10+00:00"
first_seen_at: "2026-11-12T03:46:13+00:00"
updated_at: "2026-11-12T03:50:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118632", "first_seen_at": "2026-11-12T03:46:13+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-891/", "first_seen_at": "2026-11-12T03:50:53+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-891/", "https://en.soth.pl/news/philips-hue-bridge-pro-zdi-publishes-auth-bypass-and-sql-injection-that-can-reach-root", "https://www.philips-hue.com/en-us/support/release-notes/bridge-pro"]}]
exploit_sources: []
---

# Philips Hue Bridge Pro: SQL injection lets network attackers run code as root

Link for people: https://infrastack.ai/live/CVE-2026-118632 (this .md is for agents)

SQL injection in the Hue Bridge Pro HTTPS service (TCP 443) lets a network-adjacent attacker run code as root. ZDI says authentication is required but can be bypassed (a separate flaw, CVE-2026-122044, per press). Fixed in firmware 6.1.2071524030. No exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Hue Bridge Pro affected < 6.1.2071524030 fixed 6.1.2071524030

## How to check

In the Hue app open Settings > Software update and read the Bridge Pro software version; anything older than 6.1.2071524030 is exposed. Also check the bridge is not reachable on TCP 443 from guest Wi-Fi or other untrusted segments.

## Fix

Update Hue Bridge Pro firmware to 6.1.2071524030 or later (ZDI-26-891); Signify's release notes also list 6.3.2071556020 (Oct 22, 2026).

## Timeline

- 2026-11-12T03:46:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118632
- 2026-11-12T03:50:53+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-891/ — ZDI-26-891 (primary researcher advisory) gives fix 6.1.2071524030; Signify release notes do not mention security fixes explicitly, so only fix verified. NVD lists odd affected version 2071026000. Original Hue Bridge v2 reportedly not affected (one secondary source only). No exploitation/PoC found; did not search social.

## Documents

- [advisory] ZDI-26-891 Philips Hue Bridge Pro SQL Injection RCE https://www.zerodayinitiative.com/advisories/ZDI-26-891/
- [describes] Soth.pl: Hue Bridge Pro ZDI advisories https://en.soth.pl/news/philips-hue-bridge-pro-zdi-publishes-auth-bypass-and-sql-injection-that-can-reach-root
- [fix] Hue Bridge Pro release notes https://www.philips-hue.com/en-us/support/release-notes/bridge-pro

## From the sources

Philips Hue Bridge Pro SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge Pro. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the HTTP service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-33089.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_