CVE-2026-1201

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1201", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-01-19T14:29:21.551Z", "datePublished": "2026-01-22T21:52:01.011Z", "dateUpdated": "2026-01-29T16:51:31.043Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Elevation C3", "vendor": "Hubitat", "versions": [{"lessThan": "2.4.2.157", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Elevation C4", "vendor": "Hubitat", "versions": [{"lessThan": "2.4.2.157", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Elevation C5", "vendor": "Hubitat", "versions": [{"lessThan": "2.4.2.157", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Elevation C7", "vendor": "Hubitat", "versions": [{"lessThan": "2.4.2.157", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Elevation C8", "vendor": "Hubitat", "versions": [{"lessThan": "2.4.2.157", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Elevation C8 pro", "vendor": "Hubitat", "versions": [{"lessThan": "2.4.2.157", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Aaron 'theHastyOne' Hasty of Ostrich Lab reported this vulnerability to CISA."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside of their authorized scope via client-side request manipulation.<br><br>"}], "value": "An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside of their authorized scope via client-side request manipulation."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-01-29T16:51:31.043Z"}, "references": [{"tags": ["government-resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-06"}, {"tags": ["technical-description", "related"], "url": "https://ostrichlab.io/research-blog/?post=hubitat_writeup"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Hubitat has released the following for users to implement:<br><br>* Firmware version [2.4.2.157](<a target=\"_blank\" rel=\"nofollow\" href=\"https://community.hubitat.com/t/release-2-4-2-available/154531/10\">https://community.hubitat.com/t/release-2-4-2-available/154531/10</a>)<br>"}], "value": "Hubitat has released the following for users to implement:\n\n* Firmware version [2.4.2.157]( https://community.hubitat.com/t/release-2-4-2-available/154531/10 )"}], "source": {"discovery": "UNKNOWN"}, "title": "Authorization Bypass Through User-Controlled Key in Hubitat Elevation Hubs", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T20:12:37.957880Z", "id": "CVE-2026-1201", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T20:12:48.249Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1201", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-23T20:12:37.957880Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T20:12:43.981Z"}}], "cna": {"title": "Authorization Bypass Through User-Controlled Key in Hubitat Elevation Hubs", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Aaron 'theHastyOne' Hasty of Ostrich Lab reported this vulnerability to CISA."}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hubitat", "product": "Elevation C3", "versions": [{"status": "affected", "version": "0", "lessThan": "2.4.2.157", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Hubitat", "product": "Elevation C4", "versions": [{"status": "affected", "version": "0", "lessThan": "2.4.2.157", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Hubitat", "product": "Elevation C5", "versions": [{"status": "affected", "version": "0", "lessThan": "2.4.2.157", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Hubitat", "product": "Elevation C7", "versions": [{"status": "affected", "version": "0", "lessThan": "2.4.2.157", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Hubitat", "product": "Elevation C8", "versions": [{"status": "affected", "version": "0", "lessThan": "2.4.2.157", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Hubitat", "product": "Elevation C8 pro", "versions": [{"status": "affected", "version": "0", "lessThan": "2.4.2.157", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Hubitat has released the following for users to implement:\n\n* Firmware version [2.4.2.157]( https://community.hubitat.com/t/release-2-4-2-available/154531/10 )", "supportingMedia": [{"type": "text/html", "value": "Hubitat has released the following for users to implement:<br><br>* Firmware version [2.4.2.157](<a target=\"_blank\" rel=\"nofollow\" href=\"https://community.hubitat.com/t/release-2-4-2-available/154531/10\">https://community.hubitat.com/t/release-2-4-2-available/154531/10</a>)<br>", "base64": false}]}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-06", "tags": ["government-resource"]}, {"url": "https://ostrichlab.io/research-blog/?post=hubitat_writeup", "tags": ["technical-description", "related"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside of their authorized scope via client-side request manipulation.", "supportingMedia": [{"type": "text/html", "value": "An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside of their authorized scope via client-side request manipulation.<br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-01-29T16:51:31.043Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1201", "state": "PUBLISHED", "dateUpdated": "2026-01-29T16:51:31.043Z", "dateReserved": "2026-01-19T14:29:21.551Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-01-22T21:52:01.011Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Elevation C3", "vendor": "Hubitat", "versions": [{"lessThan": "2.4.2.157", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Elevation C4", "vendor": "Hubitat", "versions": [{"lessThan": "2.4.2.157", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Elevation C5", "vendor": "Hubitat", "versions": [{"lessThan": "2.4.2.157", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Elevation C7", "vendor": "Hubitat", "versions": [{"lessThan": "2.4.2.157", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Elevation C8", "vendor": "Hubitat", "versions": [{"lessThan": "2.4.2.157", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Elevation C8 pro", "vendor": "Hubitat", "versions": [{"lessThan": "2.4.2.157", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "ics-cert@hq.dhs.gov"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside of their authorized scope via client-side request manipulation."}, {"lang": "es", "value": "Una vulnerabilidad de elusi\u00f3n de autorizaci\u00f3n a trav\u00e9s de una clave controlada por el usuario en los controladores de automatizaci\u00f3n del hogar Hubitat Elevation anteriores a la versi\u00f3n 2.4.2.157 podr\u00eda permitir a un usuario remoto autenticado controlar dispositivos conectados fuera de su \u00e1mbito de autorizaci\u00f3n mediante la manipulaci\u00f3n de solicitudes del lado del cliente."}], "id": "CVE-2026-1201", "lastModified": "2026-06-17T10:15:19.260", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1201", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-23T20:12:37.957880Z", "version": "2.0.3"}}]}, "published": "2026-01-22T22:16:16.130", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://ostrichlab.io/research-blog/?post=hubitat_writeup"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-06"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T18:58:11.476184+00:00", "value": {"mitigation_remediation": ["Upgrade all Hubitat Elevation hubs to firmware 2.4.2.157 or newer, following the vendor\u2019s release instructions.", "Restrict access to the hub\u2019s web interface or API by applying network segmentation or firewall rules so that only trusted devices can connect, and consider disabling remote administration until the patch is verified.", "Enable automatic firmware updates when available, or set up a regular update schedule to receive future security releases promptly."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Device Control"}, "threat_synthesis": {"affected_systems": "The flaw applies to all Hubitat Elevation models, including Elevation C3, C4, C5, C7, C8, and the elevated C8 Pro, when running firmware earlier than 2.4.2.157.", "description_and_impact": "An authorization bypass exists in Hubitat Elevation firmware versions prior to 2.4.2.157. Once authenticated to the hub, a user can modify a key in client\u2011side requests that the hub trusts, leading the controller to execute device commands that fall outside the user\u2019s allowed device scope. The result is that an attacker can remotely control devices they should not be able to, compromising the integrity and availability of the home automation system.", "risk_and_exploitability": "The CVSS score of 9.4 places this vulnerability in the critical range. The EPSS score of <1% indicates a very low probability of exploitation, but the ability to bypass authorization makes it highly valuable to an attacker. The flaw is not currently listed in the CISA KEV catalog. Attackers simply need already authenticated access to the hub\u2019s interface or API and can manipulate request parameters to instruct the hub to control devices outside their legitimate permissions."}}}}, "created": "2026-01-23T10:27:19.584189+00:00", "updated": "2026-04-18T19:00:08.046575+00:00", "vendors": ["hubitat", "hubitat$PRODUCT$elevation_c3", "hubitat$PRODUCT$elevation_c4", "hubitat$PRODUCT$elevation_c5", "hubitat$PRODUCT$elevation_c7", "hubitat$PRODUCT$elevation_c8", "hubitat$PRODUCT$elevation_c8_pro"]}