ZDI-CAN-33089: ZDI-26-891: Philips Hue Bridge Pro SQL Injection Remote Code Execution Vulnerability
Published Nov 6, 2026
·Updated
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge Pro. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 8.0. The following CVEs are assigned: CVE-2026-118632.
Event History
Nov 6, 2026
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
Who can exploit this vulnerability?
A network-adjacent attacker can exploit affected Philips Hue Bridge Pro installations. Authentication is nominally required, but the existing authentication mechanism can be bypassed.
2
What is the impact of successful exploitation?
Successful exploitation allows an attacker to execute arbitrary code on the affected Philips Hue Bridge Pro installation.