Philips Hue Bridge
From Wiki-IoT
Revision as of 12:37, 25 October 2026 by QF20232859 (talk | contribs) (Created page with "{{Classification |name=Philips Hue Bridge |brand=Philips Hue |parent_company=Signify (formerly Philips Lighting) |website=https://www.philips-hue.com/ |release_date=2015-10-01...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
| Philips Hue Bridge | ||
|---|---|---|
|
Security Grade
Calculator v
|
Philips Hue Bridge
Brand: Philips Hue (Parent: Signify (formerly Philips Lighting)) Category: Smart Home Hub (ZigBee Bridge) • Model / Gen: 2 Hue Bridge V2 (square) Release Date: 2015-10-01 • Status: In sale Classification Date: • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | None | 🔗 Proof | No documented hardware tampering; sealed consumer hub |
| Known vulnerabilities | Very common | 🔗 Proof | IEEE S&P 2017 recovered OTA keys & built ZigBee worm; CVE-2020-6007 (Check Point); CVE-2026-3557 root RCE; Synacktiv 2026 RCE from ZigBee network |
| Prior attacks | None | 🔗 Proof | Not associated with major botnets like Mirai |
| Updatability | Very common | 🔗 Proof | Regular firmware updates with public release notes; automatic updates supported |
| Category Score | Score: 2 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Partial | 🔗 Proof | ZigBee pairing auth is weak; whitelist token is MD5 of MAC (arXiv 2016); Check Point bypassed auth by masquerading as a bulb |
| Communications | Encrypted with obselete encryption | 🔗 Proof | ZigBee link encrypted but OTA encryption keys were recovered (IEEE S&P 2017); RCE achievable from ZigBee network |
| Storage | Encrypted with obselete encryption | 🔗 Proof | Configuration data on bridge; firmware encryption previously defeated by key recovery |
| Category Score | Score: 2 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Full | 🔗 Proof | Hue app supports home users and Philips account management |
| Authentication | Basic | 🔗 Proof | API whitelist token was MD5 of device MAC address, computable by attacker |
| Brute-force protection | Basic | 🔗 Proof | Local bridge API has no strong rate-limiting policy documented |
| Event logging | Partial logging | 🔗 Proof | Bridge keeps debug/event logs but no full security audit log |
| Passwords | Require change after setup with complexity requirements | 🔗 Proof | No default device password; Philips account required for cloud features |
| Category Score | Score: 2 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Proprietary firmware (Companion App: Philips Hue App) |
| Hardware (CPU / GPU) | CPU: • GPU: |
| Memory & Storage | Memory: • Storage: |
| Power, Battery & Charging | Battery: None (wired) • Power: 5V DC adapter, Ethernet powered • Charging: |
| Display & Camera | Display: None (LED only) • Camera: none |
| Sound & Connectivity | Sound: none • Connectivity: Ethernet, ZigBee 802.15.4, Bluetooth (HomeKit pairing) |
| Physical (Dimensions & Mass) | Dimensions: • Mass: |
