Authentication Bypass in Philips Hue Bridge Pro (CVE‑2026‑122044)
What It Is — The Zero Day Initiative disclosed a critical authentication‑bypass flaw (CVE‑2026‑122044) in the Philips Hue Bridge Pro. The vulnerability resides in the built‑in HTTPS service (TCP 443) and stems from a missing protection mechanism. An attacker on the same local network can connect to the bridge without presenting any credentials, gaining full control of the device. The issue scores 8.8 (CVSS v3.1) and is exploitable without user interaction. Philips released firmware 6.1.2071524030 (or later) that patches the flaw.
Affected Products — Philips Hue Bridge Pro (all firmware versions prior to 6.1.2071524030).
Why It Matters for Trust & Control Assurance — This bug directly challenges the access‑control control objective that underpins many frameworks (e.g., NIST CSF 2.0). Demonstrating that authentication mechanisms are enforced and auditable is a core trust signal.
Recommended Actions —
- Upgrade every Hue Bridge Pro to firmware 6.1.2071524030 or newer.
- Verify the running version via the device UI or API.
- Segment IoT devices on a dedicated VLAN or firewall zone.
- Enable logging of all bridge‑API calls and monitor for anomalous activity.
- Document the remediation in your control‑evidence repository.
Source: Zero Day Initiative Advisory