The vulnerability is an authentication bypass in Philips Hue Bridge’s HomeKit Accessory Protocol service. The service listens on the default TCP port 8080 and does not require authentication to access its functionality. As described in the CVE advisory, an attacker can locate the bridge on the local network, send requests to this port, and control or manipulate the bridge without any credentials. The weakness is identified as CWE-306, reflecting a failure to enforce proper authentication.

The affected product is Philips Hue Bridge. No specific firmware or model versions are listed in the available data, so the issue is presumed to affect all current models and firmware releases. The lack of version boundaries is explicitly noted.

The CVSS score of 8.1 indicates high severity, but the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not cataloged in the CISA KEV list. Based on the description, the likely attack vector is local network adjacency via TCP port 8080; authentication is not required, so an attacker merely needs network access to the bridge to issue malicious requests.