A recent discovery by security researchers found a potential flaw in the Philips hue lighting range that could lead to the spread of malware on devices connected to your network.The CVE-2020-6007 flaw exists in the Zigbee wireless protocol used to communicate with IoT devices.
Hackers can exploit the light via the Zigbee protocol and infect the bridge it’s connected to. The hackers first implant malware on the light itself and tamper with the settings, making it look as if something is wrong with the light. The light appears to be unreachable on the App and the user will try to reset it and re-add it to the bridge.
The compromised light when re-added to the network, will use Zigbee protocol vulnerabilities to activate a heap-based buffer overflow on the control bridge by sending huge amounts of data. The data sent will also infect the said control bridge- which is, in turn, is connected to the wifi network.
The malware connects back to the hacker by using already know exploits like EternalBlue, they can now infiltrate the IP networks from the bridge and spread spyware and ransomware to devices connected to the network. Philips is aware of this issue and has pushed out an update to which you should update as soon as possible for your safety.