PT-2017-13690 · Philips · Philips Hue Bridge

Published 2017-09-30 · Updated 2017-11-21 · CVE-2017-14797

Positive Technologies (AI Summary)

CVSS v2.0

7.9

High

Base vector

AV:A/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Philips Hue Bridge BSB002 version 1707040932

Description The issue is related to a lack of transport encryption in the public API, allowing remote attackers to read API keys by sniffing HTTP traffic on the local intranet network. This can lead to bypassing the pushlink protection mechanism and obtaining complete control of connected accessories.

Recommendations For Philips Hue Bridge BSB002 version 1707040932, consider disabling the public API until a patch is available to add transport encryption, and restrict access to the local intranet network to minimize the risk of exploitation.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2017-14797

Affected Products

Philips Hue Bridge

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-14797 · Security Note
• https://osv.dev/vulnerability/CVE-2017-14797 · Vendor Advisory
• https://tiferrei.com/philips-we-need-to-talk · Note