Philips Hue Bridge Pro Vulnerable to Restricted File Write via Argument Injection
A vulnerability in Philips Hue Bridge Pro allows local attackers to write to restricted files, requiring prior code execution within a container.
Zero Day Initiative (ZDI) has disclosed a new vulnerability affecting the Philips Hue Bridge Pro, identified as ZDI-26-890. This flaw, tracked under CVE-2026-118631, enables local attackers to achieve a restricted file write, potentially leading to system compromise.
The vulnerability resides within the factory data service, which typically listens on TCP port 5001. The core issue stems from inadequate validation of user-supplied strings before they are used in system calls. This oversight allows an attacker, who has already gained the ability to execute low-privileged code within a container on the target system, to manipulate files with the privileges of the service account.
Exploitation of this vulnerability requires a prerequisite: the attacker must first establish a foothold within a container on the Hue Bridge Pro and gain the ability to run code with low privileges. Once this initial access is secured, the argument injection flaw can be leveraged to modify critical system files. The CVSS score assigned by ZDI is 3.8, indicating a moderate severity.
Philips has addressed this vulnerability by releasing firmware version 6.1.2071524030 for the Bridge Pro. Users are strongly advised to update their devices to this latest firmware to mitigate the risk associated with CVE-2026-118631. The release notes for this update can be found on the Philips Hue support website.
The disclosure timeline indicates that the vulnerability was reported to the vendor on August 27, 2026, followed by a coordinated public release of the advisory on November 6, 2026. This timeframe aligns with standard responsible disclosure practices, allowing the vendor sufficient time to develop and distribute a patch.
This discovery was made by Connor Ford of TrendAI, working with the Zero Day Initiative. The vulnerability highlights the ongoing need for robust input validation, even in specialized IoT devices like smart home hubs, especially when they incorporate containerized environments.
While the CVSS score is moderate, the requirement for prior code execution within a container means that successful exploitation could have significant implications for users who have not secured their internal network environments or who may have inadvertently allowed unauthorized code execution on their devices.