# BrightSign OS flaw lets code on a player escalate privileges (CVE-2025-3925)

- Date: 2025-05-06
- Location: Global
- Type: Vulnerability
- Sector: Other
- CVE: CVE-2025-3925
- Products: [BrightSign](https://signagelist.org/products/brightsign/)

CISA's ICS advisory ICSA-25-126-03 covers an execution with unnecessary privileges weakness in BrightSign OS series 4 before 8.5.53.1 and series 5 before 9.0.166. CISA scored it 8.5 under CVSS v4 and described it as remotely exploitable with low attack complexity. Once code runs on a player, the flaw can be used for privilege escalation, and the fixed OS releases close it.

## Sources

- [ICSA-25-126-03 BrightSign Players](https://www.cisa.gov/news-events/ics-advisories/icsa-25-126-03) (CISA)
- [CVE-2025-3925](https://nvd.nist.gov/vuln/detail/CVE-2025-3925) (NIST NVD)
- [https://www.brightsign.biz/resources/software-downloads/](https://www.brightsign.biz/resources/software-downloads/)

Page: https://signagelist.org/incidents/2025-05-brightsign-os-flaw-lets-code-on-a/