Philips Hue Bridge (2nd Generation)

Philips Hue Bridge (2nd Generation)
Security Grade C Calculator v1	Philips Hue Bridge (2nd Generation) Brand: Signify (Philips) (Parent: Signify N.V.) Category: Smart Lighting Hub • Model / Gen: 2nd Generation BSB002 Release Date: 2016-01-01 • Status: In sale Classification Date: 2026-11-01 • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	None	🔗 Proof	Small indoor device with limited physical attack value. Physical tampering provides minimal security advantage.
Known vulnerabilities	Rare	🔗 Proof	Some Zigbee-related vulnerabilities demonstrated including "Zigbee Bee" attack vector, but practical exploitation requires close physical proximity.
Prior attacks	None	🔗 Proof	Smart lighting systems have not been used in large-scale botnet campaigns or mass malware infections.
Updatability	Very common	🔗 Proof	Philips regularly pushes firmware updates to the Hue Bridge, often adding new features and security improvements.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Local API has historically had weak authentication with no password required for LAN access. Cloud authentication is more robust but optional for basic functionality.
Communications	Encrypted with obselete encryption	🔗 Proof	Cloud communications use TLS, but Zigbee communications to bulbs are unencrypted by default. Local API often serves over plain HTTP.
Storage	No encryption	🔗 Proof	Bridge stores minimal sensitive data. Configuration and API keys stored in flash without strong encryption.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	Hue app supports multiple users, but permission granularity is limited. Local API access controls are very basic.
Authentication	Basic	🔗 Proof	Cloud accounts use password authentication. Local API requires button press pairing but no ongoing authentication for LAN clients.
Brute-force protection	Basic	🔗 Proof	Cloud accounts have rate limiting. Local API has no protection since it relies on physical button press for pairing.
Event logging	Partial logging	🔗 Proof	Basic configuration change logs exist, but no detailed user access log or security event history for users to review.
Passwords	Require change after setup	🔗 Proof	Users must set up a Philips Hue account with a password. Complexity requirements are moderate.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	(Companion App: Philips Hue App)
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Ethernet, Zigbee
Physical (Dimensions & Mass)	Dimensions: • Mass: