{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118631", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2026-10-28T16:58:46.034Z", "datePublished": "2026-11-12T02:52:04.600Z", "dateUpdated": "2026-11-12T02:52:04.600Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-11-12T02:52:04.600Z"}, "title": "Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability", "descriptions": [{"lang": "en", "value": "Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability. This vulnerability allows local attackers to modify files on affected installations of Philips Hue Bridge Pro. An attacker must first obtain the ability to execute low-privileged code within a container on the target system, in order to exploit this vulnerability.\n\nThe specific flaw exists within the factory data service, which listens on TCP port 5001 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to modify files in the context of the service account. Was ZDI-CAN-33090."}], "affected": [{"vendor": "Philips", "product": "Hue Bridge Pro", "versions": [{"version": "2071026000", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-88", "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-890/", "name": "ZDI-26-890", "tags": ["x_research-advisory"]}], "dateAssigned": "2026-10-28T16:58:46.061Z", "datePublic": "2026-11-06T22:17:21.881Z", "source": {"lang": "en", "value": "Connor Ford @ByteInsight of TrendAI Zero Day Initiative"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", "baseScore": 3.8, "baseSeverity": "LOW"}}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Hue Bridge Pro", "vendor": "Philips", "versions": [{"status": "affected", "version": "2071026000"}]}], "source": "zdi-disclosures@trendmicro.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability. This vulnerability allows local attackers to modify files on affected installations of Philips Hue Bridge Pro. An attacker must first obtain the ability to execute low-privileged code within a container on the target system, in order to exploit this vulnerability.\n\nThe specific flaw exists within the factory data service, which listens on TCP port 5001 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to modify files in the context of the service account. Was ZDI-CAN-33090."}], "id": "CVE-2026-118631", "lastModified": "2026-11-12T03:17:10.057", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.0, "impactScore": 1.4, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}, "published": "2026-11-12T03:17:10.057", "references": [{"source": "zdi-disclosures@trendmicro.com", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-890/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-88"}], "source": "zdi-disclosures@trendmicro.com", "type": "Primary"}]}

{}

{}