CVE-2026-3555

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3555", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2026-03-04T19:42:29.133Z", "datePublished": "2026-03-13T20:36:40.448Z", "dateUpdated": "2026-03-16T20:16:14.612Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-03-13T20:36:40.448Z"}, "title": "Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability", "descriptions": [{"lang": "en", "value": "Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. User interaction is required to exploit this vulnerability in that the user must initiate the device pairing process.\n\nThe specific flaw exists within the handling of custom Zigbee ZCL frames in the Model Info download functionality. The issue results from the lack of proper validation of the size of data prior to copying it to a fixed-size heap buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28276."}], "affected": [{"vendor": "Philips", "product": "Hue Bridge", "versions": [{"version": "1.73.1973146020", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-153/", "name": "ZDI-26-153", "tags": ["x_research-advisory"]}], "dateAssigned": "2026-03-04T19:42:29.193Z", "datePublic": "2026-03-06T21:19:00.069Z", "source": {"lang": "en", "value": "Mehdi Talbi, Matthieu Breuil, Th\u00e9o Gordyjan from @Synacktiv"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8, "baseSeverity": "HIGH"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T20:15:51.424960Z", "id": "CVE-2026-3555", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T20:16:14.612Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3555", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-16T20:15:51.424960Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T20:16:10.797Z"}}], "cna": {"title": "Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability", "source": {"lang": "en", "value": "Mehdi Talbi, Matthieu Breuil, Th\u00e9o Gordyjan from @Synacktiv"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Philips", "product": "Hue Bridge", "versions": [{"status": "affected", "version": "1.73.1973146020"}], "defaultStatus": "unknown"}], "datePublic": "2026-03-06T21:19:00.069Z", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-153/", "name": "ZDI-26-153", "tags": ["x_research-advisory"]}], "dateAssigned": "2026-03-04T19:42:29.193Z", "descriptions": [{"lang": "en", "value": "Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. User interaction is required to exploit this vulnerability in that the user must initiate the device pairing process.\n\nThe specific flaw exists within the handling of custom Zigbee ZCL frames in the Model Info download functionality. The issue results from the lack of proper validation of the size of data prior to copying it to a fixed-size heap buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28276."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-03-13T20:36:40.448Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3555", "state": "PUBLISHED", "dateUpdated": "2026-03-16T20:16:14.612Z", "dateReserved": "2026-03-04T19:42:29.133Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2026-03-13T20:36:40.448Z", "assignerShortName": "zdi"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Hue Bridge", "vendor": "Philips", "versions": [{"status": "affected", "version": "1.73.1973146020"}]}], "source": "zdi-disclosures@trendmicro.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:philips:hue_bridge_v2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4C925A5-D9FB-482D-A98D-F879B1BD21EC", "versionEndExcluding": "1975170000", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:philips:hue_bridge_v2:-:*:*:*:*:*:*:*", "matchCriteriaId": "55B37D18-3A59-423E-9D73-F80DFDB14C4D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. User interaction is required to exploit this vulnerability in that the user must initiate the device pairing process.\n\nThe specific flaw exists within the handling of custom Zigbee ZCL frames in the Model Info download functionality. The issue results from the lack of proper validation of the size of data prior to copying it to a fixed-size heap buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28276."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo por desbordamiento de b\u00fafer basado en mont\u00edculo en el gestor de comandos personalizado de la pila Zigbee de Philips Hue Bridge. Esta vulnerabilidad permite a atacantes adyacentes a la red ejecutar c\u00f3digo arbitrario en instalaciones afectadas de Philips Hue Bridge. Se requiere interacci\u00f3n del usuario para explotar esta vulnerabilidad, ya que el usuario debe iniciar el proceso de emparejamiento del dispositivo.\n\nLa falla espec\u00edfica existe dentro del manejo de tramas Zigbee ZCL personalizadas en la funcionalidad de descarga de informaci\u00f3n del modelo. El problema resulta de la falta de validaci\u00f3n adecuada del tama\u00f1o de los datos antes de copiarlos a un b\u00fafer de mont\u00edculo de tama\u00f1o fijo. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del dispositivo. Fue ZDI-CAN-28276."}], "id": "CVE-2026-3555", "lastModified": "2026-06-17T10:43:46.797", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3555", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T20:15:51.424960Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:19:48.493", "references": [{"source": "zdi-disclosures@trendmicro.com", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-153/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.73.1973146020"}}], "enrichment": {"confidence": 97.0, "confidence_source": "matching", "scores": [{"score": 97.0, "source": "matching"}]}, "original": {"product": "Hue Bridge", "source": "cna", "vendor": "Philips"}, "product": "hue_bridge", "vendor": "phillips"}], "analysis": {"en": {"generated_at": "2026-03-16T23:44:49.363883+00:00", "value": {"mitigation_remediation": ["Check the Philips Hue support site for firmware updates addressing the buffer overflow.", "If an update is available, apply it immediately to all Hue Bridge devices.", "If no update exists, isolate the Hue Bridge on a dedicated VLAN or network segment and block unauthorized Zigbee pairing traffic.", "Enable network monitoring to detect abnormal pairing attempts and enforce strict access controls."], "summary": {"action": "Apply Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected systems are Philips Hue Bridge devices. No specific firmware or model versions are provided in the data, so all current and unpatched installations of Philips Hue Bridge are potentially vulnerable.", "description_and_impact": "The vulnerability is a heap-based buffer overflow in the Philips Hue Bridge Zigbee stack during the handling of custom Zigbee ZCL frames in the Model Info download functionality. Because the firmware does not validate the size of the data before copying it to a fixed\u2011size heap buffer, a network\u2011adjacent attacker can trigger the overflow and execute arbitrary code in the context of the device. This remote code execution can potentially allow the attacker to compromise the bridge\u2019s firmware and any home automation functions it controls.", "risk_and_exploitability": "The CVSS score is 8, indicating high severity, and the EPSS score is less than 1%, indicating a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local\u2011network attacker and user interaction to initiate the device pairing process, so the attack vector is network\u2011adjacent with user interaction."}}}}, "created": "2026-03-16T09:23:52.100385+00:00", "updated": "2026-03-23T13:39:55.811214+00:00", "vendors": ["phillips", "phillips$PRODUCT$hue_bridge"]}