Skip to content
OpenAdvisories
Unscored Public exploit CVE-2019-18980 EUVD-2019-8640GHSA-wf72-r867-38x7

On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's …

Published Nov 14, 2019 · Updated Aug 5, 2024 · Assigned by mitre

Description

On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. The only requirement is that the attacker have network access to the bulb.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • anmolksachan/wiz-bulb-tool ★ 1 · Oct 29, 2026

    WiZ smart bulb LAN security tool - auto-discovery, CVE-tagged audit, intel recon & device control. Extends CVE-2019-18980 to new hardware. No credentials required.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References