PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-1201 Hubitat CVE debrief

CVE-2026-1201 is a critical authorization bypass issue in Hubitat Elevation home automation controllers. According to CISA’s advisory, a remote authenticated user could manipulate client-side requests to control connected devices outside their authorized scope in versions prior to 2.4.2.157.

Vendor
Hubitat
Product
Elevation C3
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-22
Original CVE updated
2026-01-22
Advisory published
2026-01-22
Advisory updated
2026-01-22

Who should care

Organizations and households using Hubitat Elevation C3/C4/C5/C7/C8/C8 Pro hubs, especially administrators responsible for device access controls, authenticated user roles, and home/OT automation safety.

Technical summary

The advisory describes an Authorization Bypass Through User-Controlled Key weakness, referenced alongside CWE-639. The affected exposure is remote and requires authentication, but successful exploitation can cross authorization boundaries and permit control of connected devices beyond intended user privileges. CISA lists firmware 2.4.2.157 as the mitigation.

Defensive priority

Immediate

Recommended defensive actions

  • Upgrade Hubitat Elevation hubs to firmware version 2.4.2.157 or later as soon as possible.
  • Review user roles, permissions, and any device-scoping rules to ensure authenticated users can only control approved devices.
  • Inspect logs for unusual or unauthorized device-control activity, especially requests that may indicate client-side request manipulation.
  • Limit authenticated access to the platform to only necessary users and accounts.
  • After patching, verify that device authorization boundaries still behave as expected for each user role.

Evidence notes

This debrief is based on CISA’s CSAF advisory ICSA-26-022-06 published on 2026-01-22 and the linked remediation note stating firmware version 2.4.2.157. The source corpus identifies the affected products as Hubitat Elevation C3/C4/C5/C7/C8/C8 Pro and references CWE-639. No KEV listing is included in the supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-1201 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-1201

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-1201 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-1201

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-022-06.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-06

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.