BrightSign Players Use of Default Credentials
Priority LOW 38CWE-1392Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 use a default password that is guessable with knowledge of the device information. The latest release fixes this issue for new installations; users of old installations are encouraged to change all default passwords.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00147 3rd percentileScored 2026-11-07
Fix Fixed BrightSign OS series 4 players (BrightSign): v8.5.53.1BrightSign OS series 5 players (BrightSign): v9.0.166
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| BrightSign | BrightSign OS series 4 players | before v8.5.53.1 | v8.5.53.1 | Patch available | CNA |
| BrightSign | BrightSign OS series 5 players | before v9.0.166 | v9.0.166 | Patch available | CNA |
- BrightSign OS series 4 players VendorBrightSign Affected before v8.5.53.1 Fixed in v8.5.53.1 Patch available CNA
- BrightSign OS series 5 players VendorBrightSign Affected before v9.0.166 Fixed in v9.0.166 Patch available CNA
Remediation
- Fix · CNA BrightSign OS series 4 players (BrightSign) Fixed in v8.5.53.1
- Fix · CNA BrightSign OS series 5 players (BrightSign) Fixed in v9.0.166
Timeline
- 2026-10-02 Threatist record created from CVE-2025-54756
- 2026-10-03 Alias added: GHSA-j8xr-3xqm-72rh
References
More BrightSign vulnerabilities
- TI-2020-19019 BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF CVSS 4.0MEDIUM 6.9
- TI-2017-12984 The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory… CVSS 3.0CRITICAL 9.8
- TI-2017-12983 The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) allows renaming… CVSS 3.0HIGH 7.5
- TI-2025-03471 BrightSign Players Execution with Unnecessary Privileges CVSS 4.0HIGH 8.5
- TI-2017-12982 The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has XSS via the… CVSS 3.0MEDIUM 6.1
Sources
- CVE-2025-54756 · CVE Program
- CVE-2025-54756 · NVD
- FIRST EPSS
- GHSA-j8xr-3xqm-72rh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences