{"id":"CVE-2026-122044","kind":"vulnerability","aliases":["CVE-2026-122044"],"related":[],"title":"Philips Hue Bridge Pro: network attacker bypasses authentication on HTTP service","description":"Philips Hue Bridge Pro Protection Mechanism Failure Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge Pro. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the HTTP service, which listens on TCP port 443 by default. The issue results from the failure to apply a protection mechanism. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-33086.","summary":"A flaw in the HTTPS service (TCP 443) of the Philips Hue Bridge Pro lets an attacker on the same network bypass authentication with no credentials (CVSS 8.8, per ZDI). Fixed in firmware 6.1.2071524030.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Philips Hue Bridge Pro","fixed":["6.1.2071524030"],"affected":"< 6.1.2071524030","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","iot","network-appliance","philips-hue","smart-lighting"],"not_affected_if":["isolated-network","no-hue-bridge-pro","patched-firmware"],"how_to_check":"In the Hue app open Settings > Software update (or the bridge info) and read the Bridge Pro software version; versions below 6.1.2071524030 are exposed. Also check that TCP 443 on the bridge is not reachable from guest Wi-Fi or other untrusted segments.","fix":"Update Bridge Pro firmware to 6.1.2071524030 or later (6.3.2071556020 is the current build): Hue app > Settings > Software update, and turn on Automatic update.","status":"open","published_at":"2026-11-12T03:17:11+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","triaged_at":"2026-11-12T03:47:26+00:00","updated_at":"2026-11-12T03:48:45+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-12T03:47:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Philips Hue Bridge Pro: network attacker bypasses authentication on HTTP service","impact":"high","summary":"The HTTP service on port 443 of the Philips Hue Bridge Pro fails to apply a protection mechanism, so authentication can be bypassed. An attacker on the adjacent network can reach the bridge without valid credentials.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["philips-hue","iot","smart-lighting","network-appliance"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker bypasses authentication and controls the bridge","analyst_note":"Find the vendor advisory and the affected and fixed firmware versions for Philips Hue Bridge Pro; NVD page is the only source given.","how_to_check":"- Identify Philips Hue Bridge Pro devices on the network and note their firmware version\n- Check whether the bridge's HTTP service on TCP port 443 is reachable from segments outside the trusted local network\n- Fix version unknown from the sources; check the vendor's advisory for affected firmware ranges","plain_action":"","product_name":"Philips Hue Bridge Pro","needs_analyst":true,"not_affected_if":["no-hue-bridge-pro","isolated-network"],"who_is_affected":"Organisations running Philips Hue Bridge Pro hardware whose HTTP service on port 443 is reachable from a network segment an attacker can reach. The sources do not give affected firmware ranges. Devices isolated from untrusted networks are less exposed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000772,"input_tokens":4643,"output_tokens":615,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory and the affected and fixed firmware versions for Philips Hue Bridge Pro; NVD page is the only source given.","search":"'-122044':14A,17A '-2026':13A,16A '33086':146C '443':40B,116C '6.1.2071524030':66B '8.8':60B 'adjac':82C 'affect':88C 'allow':79C 'appli':126C 'applianc':26B 'attack':6A,49B,83C,131C 'authent':8A,55B,74C,86C,95C,138C 'bridg':3A,45B,69C,93C 'bridge':20A 'bypass':7A,54B,75C,85C,137C 'credenti':58B 'cve':12A,15A 'cvss':59B 'default':118C 'exist':106C 'exploit':100C 'failur':73C,124C 'firmwar':65B 'fix':63B 'flaw':34B,105C 'http':10A,109C 'https':37B 'hue':2A,19A,29B,44B,68C,92C 'infrastructur':22B 'instal':89C 'iot':23B 'issu':120C 'let':47B 'leverag':133C 'light':32B 'listen':112C 'mechan':72C,129C 'network':5A,25B,53B,81C 'network-adjac':80C 'network-appli':24B 'per':61B 'philip':1A,28B,43B,67C,91C 'philips':18A 'philips-hu':27B 'port':115C 'pro':4A,21A,46B,70C,94C 'protect':71C,128C 'requir':98C 'result':121C 'servic':11A,38B,110C 'smart':31B 'smart-light':30B 'specif':104C 'system':141C 'tcp':39B,114C 'vulner':76C,78C,102C,135C 'within':107C 'zdi':62B,144C 'zdi-can':143C","nicknames":[],"mitigations":[],"who_affected":"Anyone with a Philips Hue Bridge Pro running firmware older than 6.1.2071524030. The attacker needs network access to the bridge (same LAN or any segment that reaches TCP 443), so it matters most where untrusted devices or guest Wi-Fi share the network. Bridges already updated can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Philips Hue Bridge Pro: in the Hue app go to Settings > Software update and install the latest version.","pkeys":["huebridgepro","philipshuebridgepro"],"ptokens":["bridge","hue","philips","pro"],"labels":["high","infrastructure","iot","networkappliance","philipshue","smartlighting","vendor"],"campaign_type":null,"search_a":"'-122044':14A,17A '-2026':13A,16A 'attack':6A 'authent':8A 'bridg':3A 'bridge':20A 'bypass':7A 'cve':12A,15A 'http':10A 'hue':2A,19A 'network':5A 'philip':1A 'philips':18A 'pro':4A,21A 'servic':11A","search_b":"'443':40B '6.1.2071524030':66B '8.8':60B 'applianc':26B 'attack':49B 'authent':55B 'bridg':45B 'bypass':54B 'credenti':58B 'cvss':59B 'firmwar':65B 'fix':63B 'flaw':34B 'https':37B 'hue':29B,44B 'infrastructur':22B 'iot':23B 'let':47B 'light':32B 'network':25B,53B 'network-appli':24B 'per':61B 'philip':28B,43B 'philips-hu':27B 'pro':46B 'servic':38B 'smart':31B 'smart-light':30B 'tcp':39B 'zdi':62B","search_c":"'33086':146C '443':116C 'adjac':82C 'affect':88C 'allow':79C 'appli':126C 'attack':83C,131C 'authent':74C,86C,95C,138C 'bridg':69C,93C 'bypass':75C,85C,137C 'default':118C 'exist':106C 'exploit':100C 'failur':73C,124C 'flaw':105C 'http':109C 'hue':68C,92C 'instal':89C 'issu':120C 'leverag':133C 'listen':112C 'mechan':72C,129C 'network':81C 'network-adjac':80C 'philip':67C,91C 'port':115C 'pro':70C,94C 'protect':71C,128C 'requir':98C 'result':121C 'servic':110C 'specif':104C 'system':141C 'tcp':114C 'vulner':76C,78C,102C,135C 'within':107C 'zdi':144C 'zdi-can':143C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122044","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122044","severity":null,"published_at":"2026-11-12T03:17:11+00:00","modified_at":"2026-11-12T03:17:11+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","fetched_at":"2026-11-12T03:46:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122044:3681","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-892/","severity":null,"published_at":"2026-11-12T03:48:45+00:00","modified_at":"2026-11-12T03:48:45+00:00","first_seen_at":"2026-11-12T03:48:45+00:00","fetched_at":"2026-11-12T03:48:45+00:00","note":"ZDI-26-892 (Nov 6 2026) names fix firmware 6.1.2071524030 or later; vendor release notes list that build (Sep 24) and newer 6.3.2071556020 (Oct 22). Release notes don't mention the security fix, ZDI is not the vendor, so nothing marked verified. Affected lower bound not stated. No exploitation or PoC reported.","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-892/","https://www.philips-hue.com/en-us/support/release-notes/bridge-pro","https://en.soth.pl/news/philips-hue-bridge-pro-zdi-publishes-auth-bypass-and-sql-injection-that-can-reach-root"]}],"documents":[{"id":131532,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-892/","title":"ZDI-26-892 Philips Hue Bridge Pro auth bypass","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":131533,"url":"https://www.philips-hue.com/en-us/support/release-notes/bridge-pro","title":"Hue Bridge Pro release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":131534,"url":"https://en.soth.pl/news/philips-hue-bridge-pro-zdi-publishes-auth-bypass-and-sql-injection-that-can-reach-root","title":"Soth.pl: Hue Bridge Pro ZDI advisories","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}