CVE-2026-3555: (Pwn2Own) Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability
Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. User interaction is required to exploit this vulnerability in that the user must initiate the device pairing process.
The specific flaw exists within the handling of custom Zigbee ZCL frames in the Model Info download functionality. The issue results from the lack of proper validation of the size of data prior to copying it to a fixed-size heap buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28276.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3555?
CVE-2026-3555 is classified as a high severity vulnerability that can lead to remote code execution.
How do I fix CVE-2026-3555?
To mitigate CVE-2026-3555, users should update their Philips Hue Bridge to the latest firmware version released by Philips.
What type of attack is possible with CVE-2026-3555?
CVE-2026-3555 allows network-adjacent attackers to exploit a heap-based buffer overflow vulnerability.
Which devices are impacted by CVE-2026-3555?
CVE-2026-3555 specifically affects Philips Hue Bridge devices operating on the Zigbee stack.
Can CVE-2026-3555 lead to unauthorized access?
Yes, successful exploitation of CVE-2026-3555 can enable attackers to gain unauthorized remote access to the affected Philips Hue Bridge.