# BrightSign players have 3 disclosed flaws, including cross-site scripting

- Date: 2017-12-18
- Location: Global
- Type: Vulnerability
- Sector: Vendor
- CVE: CVE-2017-17737, CVE-2017-17738, CVE-2017-17739
- Products: [BrightSign](https://signagelist.org/products/brightsign/)

NVD published three vulnerabilities in BrightSign players, covering cross-site scripting, a security flaw and path traversal. The BrightSign Digital Signage (4k242) player, firmware 6.2.63 and below, has XSS via the REF parameter to /network_diagnostics.html or /storage_info.html.

## Sources

- [CVE-2017-17737](https://nvd.nist.gov/vuln/detail/CVE-2017-17737) (NIST NVD)
- [CVE-2017-17738](https://nvd.nist.gov/vuln/detail/CVE-2017-17738) (NIST NVD)
- [CVE-2017-17739](https://nvd.nist.gov/vuln/detail/CVE-2017-17739) (NIST NVD)
- [http://www.information-paradox.net/2017/12/brightsign-multiple-vulnerablities-cve.html](http://www.information-paradox.net/2017/12/brightsign-multiple-vulnerablities-cve.html)
- [https://www.exploit-db.com/exploits/43364/](https://www.exploit-db.com/exploits/43364/)

Page: https://signagelist.org/incidents/2017-12-brightsign-players-have-3-disclosed-flaws-including/