Philips Hue Bridge Pro SQL injection allows remote code execution
Original title: ZDI-26-891: Philips Hue Bridge Pro SQL Injection Remote Code Execution Vulnerability
Network-adjacent attackers can bypass required authentication; ZDI rates CVE-2026-118632 at CVSS 8.0.
The Zero Day Initiative published ZDI-26-891, a SQL injection flaw in Philips Hue Bridge Pro that can lead to arbitrary code execution. The attacker must be network-adjacent. Authentication is required, but ZDI says the existing authentication mechanism can be bypassed. The flaw is CVE-2026-118632 with a CVSS rating of 8.0. No versions or patch are named.
Unconfirmed: Affected versions and whether a fix is available are not stated.
- The advisory is ZDI-26-891 and the CVE is CVE-2026-118632.
- ZDI assigned a CVSS rating of 8.0.
- Attackers must be network-adjacent and can bypass authentication.
Impact: arbitrary code execution after authentication bypass
| Product | Affected |
|---|---|
| Philips Hue Bridge Pro | — |
- CVEs
- CVE-2026-118632
- Vendors
- Philips
- Products
- Hue Bridge Pro
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-118632 | — | — | — |
From the original article
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge Pro. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.