Philips Hue Bridge Pro flaws: how to tell if your Hue bridge was hit
Quick answer
On Nov 6, the TrendAI Zero Day Initiative (ZDI) published three flaws in the Philips Hue Bridge Pro. The worst lets someone already on your home network get past the bridge’s login, rated 8.8 out of 10. All three are fixed in Bridge Pro firmware 6.1.2071524030 or later, which Philips released on Sept 24. If automatic updates are on, you are very likely already patched (ZDI-26-892; Philips Hue Bridge Pro release notes).
What was found
- ZDI-26-892, login bypass (8.8): someone on the same network can bypass authentication on the bridge’s web service (port 443) without a password (ZDI).
- ZDI-26-891, code execution (8.0): a SQL injection in the same service lets an attacker run code as root. It normally needs a login, but ZDI notes that login can be bypassed (ZDI).
- ZDI-26-890, file write (3.8): a low-risk bug that only matters if an attacker can already run code inside the bridge (ZDI).
- ZDI reported them to Philips in August and published them on Nov 6, after the fix shipped.
Who’s affected
- Owners of the Hue Bridge Pro (the newer hub Philips launched in Sept 2025) running firmware older than 6.1.2071524030.
- The attacker has to be on your local network, such as your Wi-Fi, not anywhere on the internet (ZDI CVSS: network-adjacent).
Who’s not affected
- Hue Bridge Pro owners on 6.1.2071524030 or newer. The current version is 6.3.2071556020 (Oct 22) (Philips).
- The advisories name only the Bridge Pro, not other Hue bridges.
How to check
- Open the Hue app and go to Settings > Software update (the path Philips gives on its release-notes page).
- Install any pending bridge update shown there. Any bridge version of 6.1.2071524030 or higher has the fix.
- Turn on Automatic update in the same screen so future fixes install on their own.
What to do
- Update the bridge if it is behind, and keep automatic updates on.
- Keep your Wi-Fi password private and put guests on a guest network, since these flaws need local network access.
- Nothing else is needed for patched bridges. The advisories describe the bugs and the fix; they do not mention attacks.
FAQ
- Can someone across the internet do this? The advisories rate them as needing access to your local network.
- I have the older square Hue Bridge. Do I need to act? These advisories are for the Bridge Pro only. Keeping any bridge on automatic updates is still a good habit.
- Do I need to reset my bridge? Not because of these advisories. Updating firmware is the fix.