CVE-2020-6007

Description

Philips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based Buffer Overflow when handling a long ZCL string during the commissioning phase, resulting in a remote code execution.

Weakness classification

• CWE-122: Heap-based Buffer Overflow
• CWE-787: Out-of-bounds Write

Primary references

• cve@checkpoint.com — Exploit, Third Party Advisory
• cve@checkpoint.com — Product, Release Notes
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Product, Release Notes