CVE-2026-73669
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces without authentication. An unauthenticated attacker with network access to the MQTT service on a vulnerable system can read data and control connected lights. Fixed in 1.77.2071318010.
Risk Assessment
An attacker can take control of the lighting system, potentially leading to privacy breaches, disruption, or use of the device for further attacks on the network.
Recommendation
Immediately update the Philips Hue Bridge Pro firmware to version 1.77.2071318010 or later and restrict network access to the MQTT service.
Original NVD description (English source)
The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces without authentication. An unauthenticated attacker with network access to the MQTT service on a vulnerable system can read data and control connected lights. Fixed in 1.77.2071318010.