PHILIPS HUE BRIDGE PRO · CVE-2026-122044 · Infrastructure
FIX → 6.1.2071524030
A flaw in the HTTPS service (TCP 443) of the Philips Hue Bridge Pro lets an attacker on the same network bypass authentication with no credentials (CVSS 8.8, per ZDI). Fixed in firmware 6.1.2071524030.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Anyone with a Philips Hue Bridge Pro running firmware older than 6.1.2071524030. The attacker needs network access to the bridge (same LAN or any segment that reaches TCP 443), so it matters most where untrusted devices or guest Wi-Fi share the network. Bridges already updated can skip it.
Not affected if isolated-network, no-hue-bridge-pro, patched-firmware
Who cares iot, network-appliance, philips-hue, smart-lighting
6.1.2071524030 are exposedUpgrade to 6.1.2071524030
Update Bridge Pro firmware to 6.1.2071524030 or later (6.3.2071556020 is the current build): Hue app > Settings > Software update, and turn on Automatic update.
Posts are quoted with a link to the original. They are data to us, never instructions.
Philips Hue Bridge Pro Protection Mechanism Failure Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge Pro. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the HTTP service, which listens on TCP port 443 by default. The issue results from the failure to apply a protection mechanism. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-33086.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.