CVE-2026-73669
Signify Philips Hue Bridge Pro MQTT broker missing authentication
CVSS Score
7.3
EPSS Score
0.2%
EPSS Percentile
11th
The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces without authentication. An unauthenticated attacker with network access to the MQTT service on a vulnerable system can read data and control connected lights. Fixed in 1.77.2071318010.
| CWE | CWE-306 |
| Vendor | signify |
| Product | philips hue bridge pro |
| Published | Aug 13, 2026 |
| Last Updated | Aug 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for signify philips hue bridge pro
Be the first to know when new high vulnerabilities affecting signify philips hue bridge pro are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
Signify / Philips Hue Bridge Pro
0 < 1.77.2071318010
References
philips-hue.com: https://www.philips-hue.com/en-us/support/release-notes/bridge-pro philips-hue.com: https://www.philips-hue.com/en-us/support/security-advisory cve.org: https://www.cve.org/CVERecord?id=CVE-2026-73669 raw.githubusercontent.com: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-225-01.json
Credits
Buğrahan KARAHAN