Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability

November 6th, 2026
ZDI-26-890 ZDI-CAN-33090

CVE ID

CVE-2026-118631

CVSS Score

3.8 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Affected Vendors

Philips

Affected Products

Hue Bridge Pro

Vulnerability Details

This vulnerability allows local attackers to modify files on affected installations of Philips Hue Bridge Pro. An attacker must first obtain the ability to execute low-privileged code within a container on the target system, in order to exploit this vulnerability.

The specific flaw exists within the factory data service, which listens on TCP port 5001 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to modify files in the context of the service account.

Additional Details

Fixed in Bridge Pro firmware version 6.1.2071524030 (or later)
https://www.philips-hue.com/en-ca/support/release-notes/bridge-pro


Disclosure Timeline

  • 2026-08-27 - Vulnerability reported to vendor
  • 2026-11-06 - Coordinated public release of advisory
  • 2026-11-06 - Advisory Updated

Credit

Connor Ford @ByteInsight of TrendAI Zero Day Initiative

Back to Advisories