ZDI-26-154: (Pwn2Own) Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the hkhappairstorageput function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the HomeKit service.
Other sources
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-3556.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-26-154?
ZDI-26-154 is classified as a high-severity vulnerability due to its potential for remote code execution.
How do I fix ZDI-26-154?
To mitigate ZDI-26-154, ensure that you update your Philips Hue Bridge to the latest firmware version provided by Philips.
Who is affected by ZDI-26-154?
Any users of the Philips Hue Bridge are potentially affected by ZDI-26-154, especially if they are running older firmware.
What type of attack does ZDI-26-154 facilitate?
ZDI-26-154 facilitates a heap-based buffer overflow attack, allowing attackers to execute arbitrary code.
Is authentication required to exploit ZDI-26-154?
No, authentication is not required to exploit ZDI-26-154, making it more dangerous.