Critical Remote Code Execution in Philips Hue Bridge (CVE‑2026‑3560) Threatens Smart‑Home and Enterprise IoT Networks
What It Is – A heap‑based buffer overflow in the hk_hap_pair_storage_put function of the Philips Hue Bridge HomeKit service enables an unauthenticated attacker to execute arbitrary code on the device. The flaw resides in the handling of data sent to TCP port 8080.
Exploitability – The vulnerability is actively exploitable; no authentication or user interaction is required. A proof‑of‑concept was demonstrated during the Pwn2Own competition. CVSS v3.1 base score 8.8 (High) (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Products – Philips Hue Bridge (all firmware versions prior to v2 1975170000).
TPRM Impact –
- Compromise of Hue Bridges deployed in corporate environments can give attackers footholds inside internal networks.
- Lateral movement from a compromised bridge may expose downstream systems, including building‑automation, surveillance, and employee devices.
- Vendors that bundle Hue Bridges into managed‑service offerings inherit the risk, expanding the supply‑chain attack surface.
Recommended Actions –
- Patch immediately – Upgrade all Hue Bridges to firmware v2 1975170000 or later.
- Network segmentation – Isolate IoT devices on separate VLANs and restrict outbound traffic from the bridge.
- Asset inventory – Verify that every Hue Bridge in your environment is accounted for and monitored.
- Intrusion detection – Deploy IDS/IPS signatures that detect anomalous traffic on TCP 8080.
- Vendor coordination – Confirm with Philips that the patch is applied and obtain a written assurance for third‑party risk registers.