CVEvulnerability

CVE-2017-14797

7.5 HIGH Published 2017-10-01 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-10-01
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.9 HIGH — AV:A/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-326

Description

Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys (and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories) by leveraging the ability to sniff HTTP traffic on the local intranet network.

Affected configurations

• philips hue bridge bsb002 firmware 1707040932

Related

Weakness · CWE (1)

  • CWE-326 Inadequate Encryption Strength weakness

References