PT-2026-7862 · Brightsign · Brightsign Players

CVE-2025-54756 · Publicado 2026-02-12 · Atualizado 2026-02-13

Positive Technologies (AI Summary)

CVSS v3.1

8.4

Alta

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BrightSign players versions prior to 8.5.53.1 (series 4) BrightSign players versions prior to 9.0.166 (series 5)

Description BrightSign players utilize a default password that can be easily guessed if device information is known. This allows potential unauthorized access to the device. The latest releases address this issue for new installations.

Recommendations BrightSign players running series 4 versions prior to 8.5.53.1 should be updated to version 8.5.53.1 or later. BrightSign players running series 5 versions prior to 9.0.166 should be updated to version 9.0.166 or later. Users with older installations are advised to change all default passwords.

Correção

Enumeração de Fraquezas

CWE-1392

Identificadores relacionados

CVE-2025-54756

Produtos afetados

Brightsign Players

Referências · 8

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-126-03.json · Nota
• https://brightsign.biz/resources/software-downloads · Nota
• https://t.me/CVEtracker/44543 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2022010384065167606 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-54756 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2021996799020728668 · Publicação no Twitter
• https://cisa.gov/news-events/ics-advisories/icsa-25-126-03 · Nota
• https://reddit.com/r/digitalsignage/comments/1r3rij9/local_access_required_is_not_the_comfort_blanket · Publicação no Reddit