Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-118632— Philips Hue Bridge Pro SQL Injection Remote Code Execution Vulnerability

Quick assessment

Affected

Philips Hue Bridge Pro

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

飞利浦 Hue Bridge Pro 存在 SQL 注入漏洞，可导致远程代码执行。该漏洞允许处于同一网络环境的攻击者在受影响的设备上执行任意代码。尽管利用此漏洞需要身份验证，但现有的身份验证机制可被绕过。该具体缺陷存在于 HTTP 服务中，该服务默认监听 TCP 443 端口。问题源于在将用户提供的字符串用于构建 SQL 查询之前，未对其进行适当的验证。攻击者可利用此漏洞以 root 用户上下文执行代码。此漏洞编号为 ZDI-CAN-33089。

AI Predicted 9.8 Difficulty: Easy Updated Nov 12, 2026

Possible ATT&CK Techniques 2 AI

T1055 · Process Injection T1190 · Exploit Public-Facing Application

Updated Nov 12, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Philips Hue Bridge Pro SQL Injection Remote Code Execution Vulnerability

Source: CVE Program / CVE List V5

Vulnerability Description

Philips Hue Bridge Pro SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge Pro. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the HTTP service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-33089.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Philips	Hue Bridge Pro	2071026000	-

II. Public POCs for CVE-2026-118632

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118632

请登录查看更多情报信息。

Other References for CVE-2026-118632 (1)

https://www.zerodayinitiative.com/advisories/ZDI-26-891/ x_research-advisory

https://www.cve.org/CVERecord?id=CVE-2026-118632

Same Patch Batch · Philips · 2026-11-12 · 3 CVEs total

CVE-2026-122044		Philips Hue Bridge Pro Protection Mechanism Failure Authentication Bypass Vulnerability
CVE-2026-118631		Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability

IV. Related Vulnerabilities

Same product: Hue Bridge Pro

Same vendor: Philips

Same weakness: CWE-89