Skip to content
OpenAdvisories
High ICSA-25-126-03 2 CVEs

BrightSign Players (Update A)

Published May 6, 2025 · Updated Jan 29, 2026 · Revision 3

Vendor: BrightSign Product: OS series 4 players Product: OS series 5 players

Summary

Successful exploitation of these vulnerabilities could allow privilege escalation on the device, easily-guessable passwords, or arbitrary code to be executed on the underlying operating system.

Vulnerabilities 2

  • High 8.4
    CVE-2025-54756

    BrightSign Players Use of Default Credentials

    BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 use a default password that is guessable with knowledge of the device information. The latest release fixes this issue for new installations; users of old insta…

    BrightSign BrightSign OS series 5 players BrightSign OS series 4 players
  • High 7.8
    CVE-2025-3925

    BrightSign Players Execution with Unnecessary Privileges

    BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 contain an execution with unnecessary privileges vulnerability, allowing for privilege escalation on the device once code execution has been obtained.

    BrightSign BrightSign OS series 4 players BrightSign OS series 5 players

Revision history

  1. #3

    Update A - added CVE-2025-54756

  2. #2

    Revision - fixed typo

  3. #1

    Initial Publication

References