Attackers can hijack WiFi using Philips Smart Lighting devices, researchers warn

Think twice before you throw out your old smart light bulbs. Hackers can extract their firmware, which stores WiFi credentials in plain text.

The Indian Computer Emergency Response Team (CERT-In) announced two critical vulnerabilities affecting Philips Smart Lighting products and Matrix Door Controller devices.

Multiple Philips smart lighting devices are affected by the first flaw, the cybersecurity firm Cyble warns.

Those include the Philips Smart WiFi LED Batten 24-Watt, the Philips Smart WiFi LED T Beamer 20-Watt, the Philips Smart Bulb models (9, 10, and 12-Watt), as well as the Philips Smart T-Bulb models (10 and 12-Watt).

If malicious actors get physical access to affected smart lighting devices with firmware versions prior to 1.33.1, they can extract WiFi credentials in cleartext, as they’re stored within the firmware.

“This flaw allows an attacker with physical access to the device to extract the firmware and analyze the binary data, ultimately revealing the plaintext WiFi credentials,” Cyble warns.

It goes downhill once attackers obtain unauthorized access to the WiFi network, which could jeopardize the security of the whole network, connected devices, and private information.

CERT-In urges users to upgrade their Philips Smart bulbs, as the new firmware will protect against potential exploitation.

The second discovered vulnerability affects the Matrix Door Controllers. According to Cyble, a bug in the session management within the web-based management interface allows remote attackers to send specially crafted HTTP requests to the device, potentially gaining unauthorized access and complete control over it.

“If exploited, this vulnerability could compromise the confidentiality, integrity, and availability of the system. While there is currently no evidence of public proof-of-concept exploitation, the potential risks remain significant, warranting immediate attention from users,” Cyble said.

The researchers suggest limiting access to the Matrix door controllers through effective network segmentation and ensuring that strong authentication mechanisms are in place for the web-based management interface. The CERT-In recommends upgrading Matrix Door Controller Cosec Vega FAXQ to firmware version V2R17.