Vulnerability · Published Jan 23, 2020 · Assigned by checkpoint
CVE-2020-6007
High 7.9
In plain English
A high-severity heap buffer overflow in Philips Hue Bridge 2.X. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).
Severity (CVSS NVD)7.9High
Exploit odds (30 days)2.1%top 17.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Philips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based Buffer Overflow when handling a long ZCL string during the commissioning phase, resulting in a remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Philips Hue Bridge 2.X | All versions prior to and including 1935144020 |
Weakness: CWE-122
References
- https://www2.meethue.com/en-us/support/release-notes/bridge x_refsource_MISC
- https://research.checkpoint.com/2020/dont-be-silly-its-only-a-lightbulb/ x_refsource_MISC