What is CVE-2017-14797?

CVE-2017-14797 is a high-severity vulnerability in Philips Hue Bridge Bsb002, classified under Inadequate Encryption Strength. CVSS score: 7.5/10. Published 2017-10-01.

How severe is CVE-2017-14797?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Philips Hue Bridge Bsb002

CVE-2017-14797

Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys (and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories) by leveraging the ability to sniff HTTP traffic on the local intranet network.

EPSS: 0.004 (34.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Philips Hue_bridge_bsb002
Philips Hue_bridge_bsb002_firmware — versions 1707040932
N/a — versions n/a

Weakness classification (CWE)

CWE-326 — Inadequate Encryption Strength

References

cve@mitre.org (x_refsource_MISC)

Frequently asked questions

What is CVE-2017-14797?: CVE-2017-14797 is a high-severity vulnerability in Philips Hue Bridge Bsb002, classified under Inadequate Encryption Strength. CVSS score: 7.5/10. Published 2017-10-01.
How severe is CVE-2017-14797?: High severity. CVSS v3 base score is 7.5 out of 10.