CVE-2020-6007

Philips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based Buffer Overflow when handling a long ZCL string during the commissioning phase, resulting in a remote code execution.

Score

CVSS 3.1 7.9 High

Status

Modified - cve@checkpoint.com

Published

2020-01-23

Last modified

2024-08-04

Weaknesses

CWE-122, CWE-787

Affected products

• Hue Bridge V2 Firmware (Philips)

References

• https://research.checkpoint.com/2020/dont-be-silly-its-only-a-lightbulb/
• https://www2.meethue.com/en-us/support/release-notes/bridge