BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or
series 5 prior to v9.0.166 use a default password that is guessable with
knowledge of the device information. The latest release fixes this
issue for new installations; users of old installations are encouraged
to change all default passwords.
BrightSign fixed CVE-2025-54756 in v8.5.53.1 (for
series 4 players) and v9.0.166 (for series 5 players). Both of these
have been released and are available on the BrightSign download site.
https://www.brightsign.biz/contact-us/
Configurations
Workarounds
BrightSign recommends the following security practices:
* Change default passwords when the device is initially set up.
* Disable the local DWS as described in "High Security settings".
* Disable the SSH/telnet server when not being used - it is not enabled by default.
* Devices should be located where an attacker does not have physical access to the device.
* SD and USB ports can be disabled if not needed.
For more information, please contact BrightSign via their website. https://www.brightsign.biz/contact-us/
Exploits
Credits
finder
Adam Merrill, a member of the Adversarial Modeling and Penetration Testing (AMPT) team at Sandia National Laboratories, reported this vulnerability to CISA.