CVE-2017-14797 - CVE House
Back to Database
Status published High CVE-2017-14797

Lack of Transport Encryption in the public API in Philips...

Vulnerability Description

Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys (and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories) by leveraging the ability to sniff HTTP traffic on the local intranet network.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-14797

Credits & Attribution

No credits recorded in the NVD database.

References

More from philips

View All →
CVE-2021-39376
Philips Healthcare Tasy Electronic Medical Record (EMR) 3.06 allows SQL...
High 8.8
CVE-2021-39375
Philips Healthcare Tasy Electronic Medical Record (EMR) 3.06 allows SQL...
High 8.8
CVE-2021-39369
In Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the...
Unknown 0
CVE-2019-18980
On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb...
High 7.5
CVE-2018-7580
Philips Hue is vulnerable to a Denial of Service attack....
High 7.5

Affected Vendor

Affected Software

hue bridge bsb002 firmware
Vulnerable Versions:
1707040932

Timeline

Official Publish: September 30th, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.