TI-2026-03072 Aliases CVE-2026-3562 GHSA-6wwq-69q4-fc36

Improper signature verification in Philips Hue Bridge

LOW 38CWE-347Published 2026-03-13 · Updated 2026-03-16

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-347.

Summary

Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ed25519_sign_open function. The issue results from improper verification of a cryptographic signature. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28480.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00289 21st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Philips	Hue Bridge	1.73.1973146020	—	No fix listed	CNA

Hue Bridge VendorPhilips Affected 1.73.1973146020 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:philips:hue_bridge_v2_firmware::::::::	before 1975170000	Vulnerable	Philips
cpe:2.3:h:philips:hue_bridge_v2:-:::::::*	not specified by NVD	Running on	Philips

cpe:2.3:o:philips:hue_bridge_v2_firmware:*:*:*:*:*:*:*:* Versions before 1975170000 Vulnerable ·Philips
cpe:2.3:h:philips:hue_bridge_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Philips

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-3562
2026-10-03 Alias added: GHSA-6wwq-69q4-fc36

References

Advisory 1

ZDI-26-160

TI-2026-03070 Heap-based buffer overflow in Philips Hue Bridge CVSS 3.0HIGH 8.8
TI-2026-03066 Heap-based buffer overflow in Philips Hue Bridge CVSS 3.0HIGH 8.8
TI-2020-04908 Heap-based buffer overflow in Philips Hue Bridge 2.X CVSS 3.1HIGH 7.9
TI-2026-03071 Heap-based buffer overflow in Philips Hue Bridge CVSS 3.0HIGH 8.0
TI-2026-03069 Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass… CVSS 3.0HIGH 8.1
TI-2026-03068 Missing authentication in Philips Hue Bridge CVSS 3.0HIGH 8.1

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences