ZDI-26-890: Philips Hue Bridge Pro Argument Injection Leads to Restricted File Write (CVE‑2026‑118631)
What It Is — The Zero Day Initiative advisory (ZDI‑26‑890) details a local argument‑injection flaw in the Philips Hue Bridge Pro’s factory data service (listening on TCP 5001). An attacker who can run low‑privileged code inside the Bridge’s container can supply an unchecked string that is passed to a system call, allowing arbitrary file modification in the context of the service account. The vulnerability is rated CVSS 3.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) and is mitigated in firmware 6.1.2071524030 (or later). No public exploitation has been reported.
Affected Products — Philips Hue Bridge Pro (all firmware versions prior to 6.1.2071524030).
Why It Matters for Trust & Control Assurance — The issue underscores the need for robust access‑control and least‑privilege enforcement on embedded services; Verisq’s ACCESS_CONTROLS capability helps you continuously verify that such controls are in place and auditable.
Recommended Actions
- Upgrade all Hue Bridge Pro devices to firmware 6.1.2071524030 or newer.
- Verify that the factory data service runs with the minimal required privileges and that its container isolation cannot be bypassed.
- Implement file‑integrity monitoring for the service‑account’s writable directories.
- Document the remediation in your change‑management system and retain firmware version evidence for audit.
Source: Zero Day Initiative Advisory