CVE-2017-14797: philips hue_bridge_bsb002_firmware Inadequate Encryption Strength

Vulnerability summary

CVE-2017-14797 is a high (CVSS 7.9) Inadequate Encryption Strength vulnerability in philips hue_bridge_bsb002_firmware. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35.3% of scored vulnerabilities.

Timeline

1. 30-09-2017
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys (and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories) by leveraging the ability to sniff HTTP traffic on the local intranet network.

• CWE-326Inadequate Encryption StrengthThe product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.