CVE-2026-73669 — Signify Philips Hue Bridge Pro MQTT broker missing authentication
The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces without authentication. An unauthenticated attacker wit…
Published: 2026-08-13 · CVSS: 6.9 · CVSS 4.0
The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces without authentication. An unauthenticated attacker with network access to the MQTT service on a vulnerable system can read data and control connected lights. Fixed in 1.77.2071318010.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7