ZDI 2026-03-06

ZDI-26-160: (Pwn2Own) Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability

CVE-2026-3562

Machine-generated analysis · WAYSCloud LLM

The vulnerability affects Philips Hue Bridge and enables arbitrary code execution without authentication.

Context

The affected product is the Philips Hue Bridge, specifically involving the hk_hap Ed25519 signature verification component. The vulnerability is an authentication bypass that allows arbitrary code execution by network-adjacent attackers. The advisory notes that no authentication is required to exploit the flaw. Worth noting is the CVSS score of 6.3, indicating a moderate severity rating.

Operator considerations

Check: Determine if Philips Hue Bridge devices are present in the environment.

From Zero Day Initiative ↗

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.3. The following CVEs are assigned: CVE-2026-3562.

Read the full advisory on ZDI →

Related advisories