What’s Vulnerable › Vulnerabilities

CVE-2024-9991: Cleartext Storage of Sensitive Information Vulnerability in Philips Lighting Devices

• Severity: high (CVSS 7.0 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-25 · updated 2026-06-17
• Weakness: CWE-312

Description

This vulnerability exists in Philips lighting devices due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext Wi-Fi credentials stored on the vulnerable device. Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to the Wi-Fi network to which vulnerable device is connected.

Affected products

• Signify Innovations India Phillips Smart Bulb 10-Watt Firmware: before 1.33.1 — fixed in 1.33.1
• Signify Innovations India Phillips Smart Bulb 12-Watt Firmware: before 1.33.1 — fixed in 1.33.1
• Signify Innovations India Phillips Smart Bulb 9-Watt Firmware: before 1.33.1 — fixed in 1.33.1
• Signify Innovations India Phillips Smart T-Bulb 10-Watt Firmware: before 1.33.1 — fixed in 1.33.1
• Signify Innovations India Phillips Smart T-Bulb 12-Watt Firmware: before 1.33.1 — fixed in 1.33.1
• Signify Innovations India Phillips Smart Wi-Fi Led Batten 24-Watt Firmware: before 1.33.1 — fixed in 1.33.1
• Signify Innovations India Phillips Smart Wi-Fi Led T Beamer 20-Watt Firmware: before 1.33.1 — fixed in 1.33.1

How to fix

Upgrade to a fixed version: Signify Innovations India Phillips Smart Bulb 10-Watt Firmware 1.33.1; Signify Innovations India Phillips Smart Bulb 12-Watt Firmware 1.33.1; Signify Innovations India Phillips Smart Bulb 9-Watt Firmware 1.33.1; Signify Innovations India Phillips Smart T-Bulb 10-Watt Firmware 1.33.1; Signify Innovations India Phillips Smart T-Bulb 12-Watt Firmware 1.33.1; Signify Innovations India Phillips Smart Wi-Fi Led Batten 24-Watt Firmware 1.33.1; Signify Innovations India Phillips Smart Wi-Fi Led T Beamer 20-Watt Firmware 1.33.1. Check the vendor advisory for mitigations.

References

• https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0329

Get alerted when CVE-2024-9991 or the next vulnerability affects your stack