CVE-2019-18980: Philips Wiz bulbs vulnerable to remote takeover

CVE-2019-18980 identifies an unprotected API in Philips Wiz smart LED bulbs (model 9290022656). The control API completely lacks authentication and encryption: anyone with network access to the bulb can turn it on/off, change color and brightness without credentials. The risk is concrete in corporate environments where smart lighting systems are integrated into smart buildings or datacenters. No sophisticated tools required: network access to the device is sufficient.

The vulnerability has a CVSS score of 7.5 (High). It was officially registered on November 14, 2019 by NVD. Seven years later, the risk remains concrete: on October 29, 2026, a public tool was detected on GitHub implementing audit and remote control for Wiz bulbs, extending exploitation to new hardware beyond the original model. This recent signal indicates the attack vector remains attractive to researchers and requires defenders to reassess.

Administrators must verify if Philips Wiz bulbs are present in the corporate perimeter. If present, network segmentation is the priority: isolate bulbs from public networks and critical segments, confining them to a dedicated VLAN with controlled access rules. Check if Philips has released firmware patches (no official fixes known since 2019). Without patches, primary mitigation is network access control and monitoring of device access attempts.