The Philips Hue Bridge ships Mosquitto 2.0.22 with anonymous access enabled over any network interface. That's the surface-level description, but the underlying mechanism is more revealing than the CVE admits.
Mosquitto 2.0.0 shipped in September 2020 with a fundamental security change: anonymous access is now disabled by default. You must explicitly add allow_anonymous true in the configuration to restore the insecure behavior. This wasn't a subtle default tweak — it was a deliberate upstream hardening to break the pattern you're seeing here. If Philips integrated Mosquitto 2.0.22 after that release, someone had to consciously re-enable anonymous access, either in a config file, a build script, or a Yocto/buildroot layer that preserved the old behavior as a patch.
That distinction matters. This isn't a forgotten configuration that rotted in place — it's evidence of a downstream override of an upstream security boundary. The commit (or layer) that re-enabled anonymous access is the real artifact to trace, because it represents a deliberate decision to restore permissive behavior rather than adapt the integration to Mosquitto's new security model.
For defenders: check your firmware images for any Mosquitto configuration files, build scripts, or Yocto layers that explicitly set allow_anonymous true. If you're evaluating this device in a penetration test, a simple nmap -sV -p 1883 <bridge-ip> will confirm the exposure. The vulnerability is exploitable by any device on the same network segment — not just the local LAN, but any bridged VLAN, guest network, or compromised device sharing the broadcast domain. This is a lateral movement vector, which means post-compromise it's a force multiplier.
The EPSS score of 0.00205 reflects current attacker focus, not actual severity. LAN-adjacent MQTT exposure is a known enumeration target in offensive tooling pipelines, and the score will shift as IoT mesh networks become more valuable as pivot points. Treat this as a medium-severity finding with high post-exploitation impact, not a low-priority compliance issue.
The fix isn't just disabling anonymous access — it's auditing whether your build toolchain automatically restores insecure defaults from older Mosquitto versions. If your Yocto layer or build scripts contain patches that override Mosquitto 2.0+ security defaults, that's the integration debt to address, not just the config file.