No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.
Credit: Adam Merrill (Adversarial Modeling and Penetration Testing (AMPT) team at Sandia National Laboratories)
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2025-54756 | CWE-1392 Use of Default Credentials | 8.4 High |
BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 use a default password that is guessable with knowledge of the device information. The latest release fixes this issue for new installations; users of old installations are encouraged to change all default passwords. Mitigation: BrightSign fixed CVE-2025-3925 and CVE-2025-54756 in v8.5.53.1 (for series 4 players) and v9.0.166 (for series 5 players). Both of these have been released and are available on the BrightSign download site. ↗ Mitigation: BrightSign fixed CVE-2025-3925 and CVE-2025-54756 in v8.5.53.1 (for series 4 players) and v9.0.166 (for series 5 players). Both of these have been released and are available on the BrightSign download site. ↗ Mitigation: BrightSign fixed CVE-2025-3925 and CVE-2025-54756 in v8.5.53.1 (for series 4 players) and v9.0.166 (for series 5 players). Both of these have been released and are available on the BrightSign download site. ↗ Affected, fixed & timelineAffected:
Mitigation: BrightSign recommends the following security practices: Change default passwords when the device is initially set up. Disable the local DWS as described in "High Security settings". Disable the SSH/telnet server when not being used - it is not enabled by default. Devices should be located where attackers do not have physical access to the device. SD and USB ports can be disabled if not needed. Mitigation: For more information, please contact BrightSign via their website. |
| CVE-2025-3925 | CWE-250 Execution with Unnecessary Privileges | 7.8 High |
BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 contain an execution with unnecessary privileges vulnerability, allowing for privilege escalation on the device once code execution has been obtained. Mitigation: BrightSign fixed CVE-2025-3925 and CVE-2025-54756 in v8.5.53.1 (for series 4 players) and v9.0.166 (for series 5 players). Both of these have been released and are available on the BrightSign download site. ↗ Mitigation: BrightSign fixed CVE-2025-3925 and CVE-2025-54756 in v8.5.53.1 (for series 4 players) and v9.0.166 (for series 5 players). Both of these have been released and are available on the BrightSign download site. ↗ Mitigation: BrightSign fixed CVE-2025-3925 and CVE-2025-54756 in v8.5.53.1 (for series 4 players) and v9.0.166 (for series 5 players). Both of these have been released and are available on the BrightSign download site. ↗ Affected, fixed & timelineAffected:
Mitigation: BrightSign recommends the following security practices: Change default passwords when the device is initially set up. Disable the local DWS as described in "High Security settings". Disable the SSH/telnet server when not being used - it is not enabled by default. Devices should be located where attackers do not have physical access to the device. SD and USB ports can be disabled if not needed. Mitigation: For more information, please contact BrightSign via their website. |
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2025-54756 | 8.4 High | BrightSign BrightSign OS series 4 players BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 use a default password that is guessable with kn… |
| CVE-2025-3925 | 7.8 High | BrightSign BrightSign OS series 4 players BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 contain an execution with unnecessary privileges… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.