TI-2020-04908 Aliases CVE-2020-6007 GHSA-vf3h-hp75-rg56

Heap-based buffer overflow in Philips Hue Bridge 2.X

LOW 39CWE-122Published 2020-01-23 · Updated 2024-08-04

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

Philips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based Buffer Overflow when handling a long ZCL string during the commissioning phase, resulting in a remote code execution.

Why it matters now

EPSS 0.02132 82nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Philips Hue Bridge 2.X	All versions prior to and including 1935144020	—	No fix listed	CNA

Philips Hue Bridge 2.X Vendor— Affected All versions prior to and including 1935144020 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:philips:hue_bridge_v2_firmware::::::::	up to 1935144020	Vulnerable	Philips
cpe:2.3:h:philips:hue_bridge_v2:-:::::::*	not specified by NVD	Running on	Philips

cpe:2.3:o:philips:hue_bridge_v2_firmware:*:*:*:*:*:*:*:* Versions up to 1935144020 Vulnerable ·Philips
cpe:2.3:h:philips:hue_bridge_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Philips

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2020-6007
2026-10-03 Alias added: GHSA-vf3h-hp75-rg56

References

Exploit 1

https://research.checkpoint.com/2020/dont-be-silly-its-only-a-lightbulb/

Other 1

https://www2.meethue.com/en-us/support/release-notes/bridge

TI-2026-03070 Heap-based buffer overflow in Philips Hue Bridge CVSS 3.0HIGH 8.8
TI-2026-03066 Heap-based buffer overflow in Philips Hue Bridge CVSS 3.0HIGH 8.8
TI-2026-03072 Improper signature verification in Philips Hue Bridge CVSS 3.1HIGH 8.8
TI-2026-03071 Heap-based buffer overflow in Philips Hue Bridge CVSS 3.0HIGH 8.0
TI-2026-03069 Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass… CVSS 3.0HIGH 8.1
TI-2026-03068 Missing authentication in Philips Hue Bridge CVSS 3.0HIGH 8.1

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences