| Philips Hue Bridge (9290022856)
|
|
Security Grade
Calculator v
|
Philips Hue Bridge (square Bridge v2, model 9290022856 / BSB)
Release Date: 2021-01-09 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
The bridge is a sealed mains-powered hub; pairing requires pressing the physical top link button, which is a controlled local action rather than an exposed debug interface.
|
| Known vulnerabilities
|
Rare
|
[1] 🔗 Proof
|
Multiple published findings (CVE-2026-3561 and related 3555/3556/3562, plus older CVE-2020-6007) target Bridge v2; addressed via auto-update firmware. A cluster of disclosed issues, not a constant stream.
|
| Prior attacks
|
Rare
|
🔗 Proof
|
The Bridge v2 flaws surfaced via Pwn2Own / ZDI coordinated disclosure and academic research, not observed mass exploitation of consumer bridges.
|
| Updatability
|
Very common
|
🔗 Proof
|
The bridge updates automatically through the Hue app, with a long running release-notes history and a documented minimum 48-month support window after introduction.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Local third-party access uses a press-the-physical-link-button whitelist-user provisioning model; the bridge also pairs with HomeKit/Alexa/Google. No mutual cryptographic device-to-device auth is documented beyond these pairings.
|
| Communications
|
No encryption
|
🔗 Proof
|
The documented local Hue API is reached over plain HTTP on the LAN; remote/away control goes through Signify's cloud over HTTPS, and lights use Zigbee. Local plaintext API keeps this at No encryption.
|
| Storage
|
No encryption
|
🔗 Proof
|
Bridge configuration, whitelist credentials and schedules live on internal flash; the vendor documents no at-rest encryption of this flash.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
The Hue app manages a cloud account and local whitelist users provisioned by the link button; there is no rich multi-role local admin system.
|
| Authentication
|
Basic
|
🔗 Proof
|
Local API access uses a long random whitelist username issued only after a physical link-button press; the cloud side uses a Hue account password. No MFA is documented for the assessed profile.
|
| Brute-force protection
|
Exist
|
🔗 Proof
|
New local users cannot be created remotely; provisioning requires a physical press of the bridge's link button, and issued whitelist keys are long random tokens.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The bridge and app report system/firmware status and configured devices, but no detailed administrative access/login audit trail is published.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
There is no shared default guessable password; local credentials are auto-issued random whitelist tokens and the user creates their own Hue cloud account during setup. No published enforced complexity policy is cited.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Vendor bridge firmware (embedded); assessment: current auto-update build (Companion App: Philips Hue app (iOS/Android); plus documented local HTTP API)
|
| Hardware (CPU / GPU)
|
CPU: Not officially disclosed by Signify • GPU:
|
| Memory & Storage
|
Memory: Not officially disclosed by Signify • Storage: Internal flash holding bridge configuration, whitelist and schedules
|
| Power, Battery & Charging
|
Battery: • Power: 100–240 V AC via 5 V adapter; about 3 W • Charging:
|
| Display & Camera
|
Display: 4 status LEDs on top • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: 1× Ethernet RJ-45 to router; Zigbee (2400–2483.5 MHz) to lights/accessories; no Wi-Fi on the bridge itself
|
| Physical (Dimensions & Mass)
|
Dimensions: 88 × 88 × 26 mm (diameter × height) • Mass: 280 g
|
Documentation-based security assessment: Philips Hue Bridge (square Bridge v2, model 9290022856 / BSB). Reviewed 2026-10-24.
2
3
Documentation-based assessment of a defined Hue Bridge v2 profile connected by Ethernet to the router and controlled through the Philips Hue app bound to a Hue cloud account. First setup pairs the bridge to the app, and new third-party/local API users can only be provisioned after a physical press of the bridge's top link button, which issues a long random whitelist username. Remote/away control runs over Signify's cloud; lights and accessories join the bridge over Zigbee. Firmware updates are installed automatically through the Hue app/cloud. Bridge configuration, whitelist and schedules reside on internal flash with no documented at-rest encryption. These are the explicitly selected conditions of this document assessment, not a claim about factory defaults or an inspected physical unit.
4
5
Ratings map documented capabilities and the stated configuration to WikiIoT choices. Uncommon/Rare are qualitative assessments of documented bounded exposure/history, not measured frequencies. Prior attacks are based on Pwn2Own/ZDI coordinated disclosure and academic research, not observed mass exploitation of consumer bridges. A plaintext local HTTP API alongside HTTPS cloud control is rated Partial communications. Internal flash with no documented encryption is rated No encryption. The physical link-button pairing is treated as an anti-bruteforce control (Exist). Optional capabilities are not treated as enabled unless the assessment configuration states so. Historical CVEs do not imply that the current auto-updated firmware remains vulnerable.
6
7
Release-date scope: 2021, the documented square Hue Bridge v2 generation per the official release-notes page (which states all notes from 2020-04-30 refer to Bridge v2); not asserted to be the earliest worldwide retail date.
8
9
Historical vulnerability: CVE-2026-3561 (heap-based buffer overflow / RCE in the HomeKit HAP characteristics handler, hk_hap, network-adjacent after an authentication bypass; tracked as ZDI-CAN-28479 / ZDI-26-159), with related Bridge v2 findings CVE-2026-3555, CVE-2026-3556 and CVE-2026-3562, and the older CVE-2020-6007 Bridge v2 RCE. Affected firmware is Bridge v2 builds prior to the vendor fix; Signify ships fixes through the automatic Hue app firmware channel. Research context: Synacktiv over-the-air Zigbee exploitation and SSTIC 2026 HomeKit SRP/pairing analysis.
10
11
No physical device was tested. Keep the configuration and evidence scope with the ratings.
12
13
References:
14
Philips Hue Bridge official product page
15
Hue Bridge release notes (Bridge v2)
16
Philips Hue developer — get started (local API pairing)
17
Hue Bridge setup — top link button and LEDs
18
How Philips Hue works — Bridge Ethernet + Zigbee
19
Hue Bridge power specifications
20
Hue Bridge product dimensions and weight
21
CVE-2026-3561 — Hue Bridge v2 HAP RCE (ZDI-26-159)
22
Synacktiv — over-the-air exploitation of the Hue Bridge
23
Philips Hue security advisory / responsible disclosure
24
WikiIoT methodology
