The vulnerability is a heap‑based buffer overflow in the hap_pair_verify_handler routine of the hk_hap service, which listens on TCP port 8080 in Philips Hue Bridge. An attacker sends a specially crafted Sub‑TLV payload that exceeds the expected length; the service copies the unvalidated data into a heap buffer without bounds checking, allowing arbitrary code execution in the context of the root user. The flaw is classified as CWE‑122, and the vendor authentication mechanism can be bypassed, so the existing access control is ineffective during exploitation.

Affected systems are Philips Hue Bridge devices that run the hk_hap service on TCP 8080 and include any firmware revision that implements the current hap_pair_verify_handler routine. No specific firmware release numbers are supplied in the CNA data; therefore any Bridge device using this implementation is potentially impacted until a vendor‑issued update addresses the overflow.

The CVSS 3.1 base score of 8.0 indicates high severity. EPSS is below 1 %, and the vulnerability is not present in CISA’s KEV catalog, suggesting limited current exploitation. The attack requires only local network adjacency and the ability to send packets to port 8080; because the vulnerability can be triggered despite authentication, a single nearby device can launch the exploit. Successful exploitation results in full root control of the Bridge, enabling lateral movement or further compromise of the local network.