PT-2026-7862 · Brightsign · Brightsign Players

Published 2026-02-12 · Updated 2026-02-13 · CVE-2025-54756

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BrightSign players versions prior to 8.5.53.1 (series 4) BrightSign players versions prior to 9.0.166 (series 5)

Description BrightSign players utilize a default password that can be easily guessed if device information is known. This allows potential unauthorized access to the device. The latest releases address this issue for new installations.

Recommendations BrightSign players running series 4 versions prior to 8.5.53.1 should be updated to version 8.5.53.1 or later. BrightSign players running series 5 versions prior to 9.0.166 should be updated to version 9.0.166 or later. Users with older installations are advised to change all default passwords.

Fix

Weakness Enumeration

CWE-1392

Related Identifiers

CVE-2025-54756

Affected Products

Brightsign Players

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-54756 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-126-03.json · Note
• https://brightsign.biz/resources/software-downloads · Note
• https://t.me/CVEtracker/44543 · Telegram Post
• https://twitter.com/CVEnew/status/2022010384065167606 · Twitter Post
• https://twitter.com/TheHackerWire/status/2021996799020728668 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-25-126-03 · Note
• https://reddit.com/r/digitalsignage/comments/1r3rij9/local_access_required_is_not_the_comfort_blanket · Reddit Post