PT-2017-13690 · Philips · Philips Hue Bridge

Publicado 2017-09-30 · Atualizado 2017-11-21 · CVE-2017-14797

Positive Technologies (AI Summary)

CVSS v2.0

7.9

Alta

Vetor base

AV:A/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Philips Hue Bridge BSB002 version 1707040932

Description The issue is related to a lack of transport encryption in the public API, allowing remote attackers to read API keys by sniffing HTTP traffic on the local intranet network. This can lead to bypassing the pushlink protection mechanism and obtaining complete control of connected accessories.

Recommendations For Philips Hue Bridge BSB002 version 1707040932, consider disabling the public API until a patch is available to add transport encryption, and restrict access to the local intranet network to minimize the risk of exploitation.

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

CVE-2017-14797

Produtos afetados

Philips Hue Bridge

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-14797 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-14797 · Aviso do Fabricante
• https://tiferrei.com/philips-we-need-to-talk · Nota