Global
BrightSign players shipped guessable default password (CVE-2025-54756)
BrightSign OS series 4 before 8.5.53.1 and series 5 before 9.0.166 had a default password that can be guessed from device information. The CVE was published to NVD on February 12, 2026. The fixed firmware only covers new installations, so existing players need their passwords changed by hand.
- Type
- Vulnerability
- Sector
- Other
- Country
- Global
