CVE-2020-6007: Buffer Overflow
Philips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based Buffer Overflow when handling a long ZCL string during the commissioning phase, resulting in a remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-6007?
CVE-2020-6007 is a vulnerability in Philips Hue Bridge model 2.X that allows for remote code execution due to a heap-based buffer overflow during the commissioning phase.
What is the severity of CVE-2020-6007?
CVE-2020-6007 has a severity rating of 7.9 (high) based on the CVSS v3.0 scoring system.
How does CVE-2020-6007 affect Philips Hue Bridge?
CVE-2020-6007 affects Philips Hue Bridge model 2.X prior to and including version 1935144020.
How can CVE-2020-6007 be exploited?
CVE-2020-6007 can be exploited by an attacker sending a long ZCL string during the commissioning phase, triggering the heap-based buffer overflow and allowing for remote code execution.
Is there a fix for CVE-2020-6007?
Yes, Philips has released a firmware update that addresses the CVE-2020-6007 vulnerability. It is recommended to update the firmware to the latest version.