Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ed25519_sign_open function. The issue results from improper verification of a cryptographic signature. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28480.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 2 products
[ZDI-26-160|CVE-2026-3562] (Pwn2Own) Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability (CVSS 6.3; Credit: Viettel Cyber Security) https://www.zerodayinitiative.com/advisories/ZDI-26-160/
Post summary
A newly disclosed CVE-2026-3562 in Philips Hue Bridge allows authentication bypass via a signature verification flaw; the advisory includes technical details and a CVSS score of 6.3.
CVE-2026-3562 Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary … https://www.cve.org/CVERecord?id=CVE-2026-3562
Post summary
The post announces the Philips Hue Bridge CVE‑2026‑3562, highlighting an authentication bypass via Ed25519 signature verification that could allow network‑adjacent attackers to execute arbitrary code.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | philips | hue_bridge_v2 | - | - | - |
| OS | philips | hue_bridge_v2_firmware | - | - | - |