This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. User interaction is required to exploit this vulnerability in that the user must initiate the device pairing process. The ZDI has assigned a CVSS rating of 8.0. The following CVEs are assigned: CVE-2026-3555.
ZDI-26-153: (Pwn2Own) Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability
Kurzinfo
Metadaten
- Original (extern): Link oeffnen
- Veroeffentlicht: 2026-03-06 06:00 UTC
- Importiert: 2026-06-09 22:51 UTC
- CVSS: 8.0
- Quelle-ID:
zdi_pub - uid_hash:
e69d741e512b9864f45fc92de574c120b9b04c8a5b30452a97297b33dff3ab54
Inhalt
Verknuepfte CVEs
| CVE-ID | Severity (Quelle) | CVSS (Quelle) | Severity (CVE.org) | CVSS (CVE.org) | EPSS | EPSS-Pctl | Veroeffentlicht (CVE.org) |
|---|---|---|---|---|---|---|---|
HIGH |
8 |
HIGH |
8 |
2026-03-13 |
Quellen-Details
| Bezeichnung | Name | Kategorie | Tags | Zielgruppe | Sprache | Feed-URL |
|---|---|---|---|---|---|---|
| Zero Day Initiative (Published) | threat_intel | - | de | https://www.zerodayinitiative.com/rss/published/ |