ZDI-26-891: Philips Hue Bridge Pro SQL Injection Remote Code Execution Vulnerability
Published Nov 6, 2026
·Updated
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge Pro. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 8.0. The following CVEs are assigned: CVE-2026-118632.
Event History
Nov 6, 2026
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
Who can exploit this vulnerability?
A network-adjacent attacker can exploit affected Philips Hue Bridge Pro installations. Although authentication is normally required, the described issue includes a bypass of the existing authentication mechanism.
2
What level of impact can successful exploitation have?
Successful exploitation allows arbitrary code execution on the affected installation. ZDI assigned the issue a CVSS score of 8.0.