CVE-2026-118631
Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability
Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability. This vulnerability allows local attackers to modify files on affected installations of Philips Hue Bridge Pro. An attacker must first obtain the ability to execute low-privileged code within a container on the target system, in order to exploit this vulnerability. The specific flaw exists within the factory data service, which listens on TCP port 5001 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to modify files in the context of the service account. Was ZDI-CAN-33090.
| CWE | CWE-88 |
| Vendor | philips |
| Product | hue bridge pro |
| Published | Nov 12, 2026 |
Get instant alerts for philips hue bridge pro
Be the first to know when new low vulnerabilities affecting philips hue bridge pro are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N