CVE-2026-3562

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3562
Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ed25519_sign_open function. The issue results from improper verification of a cryptographic signature. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28480.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.zerodayinitiative.com/advisories/ZDI-26-160/ Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:philips:hue_bridge_v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:philips:hue_bridge_v2:-:*:*:*:*:*:*:*
History

27 Apr 2026, 14:28

Type Values Removed Values Added
CPE cpe:2.3:h:philips:hue_bridge_v2:-:*:*:*:*:*:*:*
cpe:2.3:o:philips:hue_bridge_v2_firmware:*:*:*:*:*:*:*:*
References () https://www.zerodayinitiative.com/advisories/ZDI-26-160/ - () https://www.zerodayinitiative.com/advisories/ZDI-26-160/ - Third Party Advisory
First Time Philips hue Bridge V2
Philips
Philips hue Bridge V2 Firmware
Summary
  • (es) Vulnerabilidad de Omisión de Autenticación por Verificación de Firma Ed25519 de hk_hap en Philips Hue Bridge. Esta vulnerabilidad permite a atacantes adyacentes a la red ejecutar código arbitrario en instalaciones afectadas de Philips Hue Bridge. La autenticación no es requerida para explotar esta vulnerabilidad. La falla específica existe dentro de la función ed25519_sign_open. El problema resulta de una verificación incorrecta de una firma criptográfica. Un atacante puede aprovechar esta vulnerabilidad para omitir la autenticación en el sistema. Fue ZDI-CAN-28480.
CVSS v2 : unknown
v3 : 6.3 		v2 : unknown
v3 : 8.8

16 Mar 2026, 14:19

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-16 14:19

Updated : 2026-04-27 14:28

NVD link : CVE-2026-3562

Mitre link : CVE-2026-3562

CVE.ORG link : CVE-2026-3562

JSON object : View

Products Affected

philips

  • hue_bridge_v2_firmware
  • hue_bridge_v2
CWE
CWE-347

Improper Verification of Cryptographic Signature