CVE-2020-6007

Philips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based Buffer Overflow when handling a long ZCL string during the commissioning phase, resulting in a remote code execution.

CVSS v3 7.9 HIGH
CVSS v2.0 4.3 MEDIUM

7.9^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:A/AC:H/Au:N/C:P/I:P/A:P

Exploitability : 3.2 / Impact : 6.4

Access Vector ADJACENT_NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://research.checkpoint.com/2020/dont-be-silly-its-only-a-lightbulb/	Exploit Third Party Advisory
https://www2.meethue.com/en-us/support/release-notes/bridge	Product Release Notes

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:philips:hue_bridge_v2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:philips:hue_bridge_v2:-:*:*:*:*:*:*:*

History

01 Mar 2023, 03:00

Type	Values Removed	Values Added
References	~~(MISC) https://research.checkpoint.com/2020/dont-be-silly-its-only-a-lightbulb/ -~~	(MISC) https://research.checkpoint.com/2020/dont-be-silly-its-only-a-lightbulb/ - Exploit, Third Party Advisory
References	~~(MISC) https://www2.meethue.com/en-us/support/release-notes/bridge - Release Notes~~	(MISC) https://www2.meethue.com/en-us/support/release-notes/bridge - Product, Release Notes

Information

Published : 2020-01-23 22:15

Updated : 2023-12-10 13:13

NVD link : CVE-2020-6007

Mitre link : CVE-2020-6007

CVE.ORG link : CVE-2020-6007

JSON object : View

Products Affected

philips

hue_bridge_v2
hue_bridge_v2_firmware

CWE

CWE-787

Out-of-bounds Write

CWE-122

Heap-based Buffer Overflow

{"id": "CVE-2020-6007", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:H/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.2, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.9, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.2}]}, "published": "2020-01-23T22:15:10.277", "references": [{"url": "https://research.checkpoint.com/2020/dont-be-silly-its-only-a-lightbulb/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@checkpoint.com"}, {"url": "https://www2.meethue.com/en-us/support/release-notes/bridge", "tags": ["Product", "Release Notes"], "source": "cve@checkpoint.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}, {"type": "Secondary", "source": "cve@checkpoint.com", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "Philips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based Buffer Overflow when handling a long ZCL string during the commissioning phase, resulting in a remote code execution."}, {"lang": "es", "value": "Philips Hue Bridge modelo 2.X versiones anteriores a 1935144020 incluy\u00e9ndola, contiene un desbordamiento de b\u00fafer en la regi\u00f3n heap de la memoria cuando se maneja una cadena ZCL larga durante la fase de comisionamiento, resultando en una ejecuci\u00f3n de c\u00f3digo remota."}], "lastModified": "2023-03-01T03:00:19.090", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:philips:hue_bridge_v2_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E33656C1-57BE-4579-8212-B8AE6E57DF08", "versionEndIncluding": "1935144020"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:philips:hue_bridge_v2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "55B37D18-3A59-423E-9D73-F80DFDB14C4D"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@checkpoint.com"}