CVE-2026-3562
Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in Philips Hue Bridge via Ed25519 Signature Flaw

Publication date: 2026-03-16

Last updated on: 2026-04-27

Assigner: Zero Day Initiative

Description
Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ed25519_sign_open function. The issue results from improper verification of a cryptographic signature. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28480.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-03-16
Last Modified
2026-04-27
Generated
2026-07-26
AI Q&A
2026-03-16
EPSS Evaluated
2026-07-25
NVD
CVE-2026-3562
EUVD
EUVD-2026-12164

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
philips hue_bridge_v2_firmware to 1975170000 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-3562 is an authentication bypass vulnerability in the Philips Hue Bridge. It exists in the ed25519_sign_open function, which is responsible for verifying Ed25519 cryptographic signatures. Due to improper verification of these signatures, an attacker who is network-adjacent can bypass authentication without needing any privileges or user interaction.

This flaw allows the attacker to execute arbitrary code on affected Philips Hue Bridge devices.

Detection Guidance

I don't know

Impact Analysis

This vulnerability can have serious impacts as it allows an attacker to bypass authentication and execute arbitrary code on the Philips Hue Bridge device remotely.

  • Compromise of device confidentiality, integrity, and availability.
  • Potential unauthorized control over the Philips Hue Bridge and connected smart home devices.
  • Possible disruption of smart home operations or misuse of the device for further attacks.
Compliance Impact

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-3562. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart