CVE-2025-54756: Brightsign OS Series 4 Players

High severity, CVSS 8.4. EPSS: 0.1% chance of exploitation in the next 30 days.

BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 use a default password that is guessable with knowledge of the device information. The latest release fixes this issue for new installations; users of old installations are encouraged to change all default passwords.

Affected products

• Brightsign Brightsign OS Series 4 Players: before v8.5.53.1 (fixed in v8.5.53.1)
• Brightsign Brightsign OS Series 5 Players: before v9.0.166 (fixed in v9.0.166)

Published 2026-02-12. Last modified 2026-06-17.