File Write Vulnerability in Philips Hue Bridge Pro Affects Local Security

CVE-2026-118631

What is CVE-2026-118631?

The Philips Hue Bridge Pro is susceptible to a file write vulnerability that enables local attackers to alter files within the system. This issue arises from inadequate validation of user-inputted strings, which are utilized in system calls by the factory data service, defaulting to TCP port 5001. An attacker gaining the ability to execute low-privileged code within the container can exploit this flaw, allowing unauthorized file modifications under the service account, potentially compromising the integrity of the affected installations. As per the advisory from Zero Day Initiative (ZDI-26-890), it is critical for users and administrators to ensure their systems are secure against such vulnerabilities.

References