What’s Vulnerable › Vulnerabilities
CVE-2019-18980
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2019-11-14 · updated 2026-06-17
- Weakness: CWE-306
Description
On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. The only requirement is that the attacker have network access to the bulb.
Affected products
References
- https://blog.dammitly.net/2019/10/cheap-hackable-wifi-light-bulbs-or-iot.html
- https://blog.dammitly.net/2019/10/cheap-hackable-wifi-light-bulbs-or-iot.html
Get alerted when CVE-2019-18980 or the next vulnerability affects your stack