Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

ZDI publishes three Philips Hue Bridge Pro vulnerability advisories

1 source · 3 articlesFirst reported Updated ()4
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

ZDI disclosed three Philips Hue Bridge Pro flaws on November 6, with no versions, patches, or known exploitation stated.

The Zero Day Initiative published three advisories for Philips Hue Bridge Pro on November 6, 2026. ZDI-26-892 (CVE-2026-122044), rated CVSS 8.8, is an authentication bypass that network-adjacent attackers can exploit without authenticating. ZDI-26-891 (CVE-2026-118632), rated 8.0, is SQL injection that can lead to arbitrary code execution; authentication is required, but ZDI says it can be bypassed. ZDI-26-890 (CVE-2026-118631), rated 3.8, lets a local attacker who already runs low-privileged code in a container write restricted files. None of the advisories name affected versions, fixes, or known exploitation.

Key facts
  • CVE-2026-122044 (ZDI-26-892) is an authentication bypass rated CVSS 8.8.
  • CVE-2026-118632 (ZDI-26-891) is SQL injection leading to code execution, rated 8.0.
  • CVE-2026-118631 (ZDI-26-890) is argument injection enabling a restricted file write, rated 3.8.
  • The two higher-severity flaws require a network-adjacent attacker.
  • The file-write flaw requires existing low-privileged code inside a container.
  • Advisories give no affected versions, patches, or exploitation status.
Analyze CVE-2026-122044 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Nov 6, 2026ZDI published three Philips Hue Bridge Pro advisories · ZDI Published Advisories

What each outlet adds

beyond the shared facts
  • ZDI Published AdvisoriesThree CVEs, CVSS scores, and distinct attack requirements
CVEs
CVE-2026-122044CVE-2026-118632CVE-2026-118631
Vendors
Philips
Products
Hue Bridge Pro
Organizations
Zero Day Initiative

Coverage

oldest first · one row per article · UTC
  1. · 5d ago ZDI Published AdvisoriesFirst report

    Philips Hue Bridge Pro flaw lets adjacent attackers bypass authentication

    ZDI rates CVE-2026-122044 at CVSS 8.8 and says no authentication is required to exploit it.

  2. · 5d ago ZDI Published Advisories

    Philips Hue Bridge Pro argument injection allows restricted file writes

    ZDI rates CVE-2026-118631 at CVSS 3.8 and requires low-privileged code inside a container first.

  3. · 5d ago ZDI Published Advisories

    Philips Hue Bridge Pro SQL injection allows remote code execution

    Network-adjacent attackers can bypass required authentication; ZDI rates CVE-2026-118632 at CVSS 8.0.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-118631
———
CVE-2026-118632
———
CVE-2026-122044
———