The vulnerability is a heap‑based buffer overflow in the hk_hap characteristics endpoint of Philips Hue Bridge. An attacker can send oversized data in a PUT request to the characteristics endpoint, bypassing the existing authentication mechanism due to improper validation of the length of user‑supplied data. This flaw (CWE‑122) allows the attacker to execute arbitrary code in the device’s context, resulting in a full compromise of confidentiality, integrity, and availability.

The affected product is Philips Hue Bridge. No specific firmware or model versions are listed in the provided data, so all current installations may be vulnerable until an official patch is released.

The CVSS score of 8.0 indicates high severity. The EPSS score of less than 1% suggests a relatively low probability of exploitation at the moment, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an adversary to be network‑adjacent to the Hue Bridge and to send a crafted PUT request to the characteristics endpoint. Authentication can be bypassed, so the attack vector is local network, pre‑authenticated, and relatively straightforward for a nearby attacker.