CVE-2025-54756 - Vulnerability Analysis

Overview

BrightSign BrightSign OS series 4 < 8.5.53.1 and series 5 < 9.0.166 contain a broken authentication caused by use of guessable default passwords, letting attackers gain unauthorized access, exploit requires knowledge of device information.

Severity & Score

Impact

Attackers can gain unauthorized access by guessing default passwords, potentially leading to full system compromise.

Mitigation

Update to BrightSign OS series 4 version 8.5.53.1 or series 5 version 9.0.166 or later.

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-126-03.json
• https://www.brightsign.biz/resources/software-downloads/
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-126-03

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 12, 2026

🟠 CVE-2025-54756 - High (8.4) BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 use a default password that is guessable with knowledge of the device information. The latest release fixes this issue for new installations; use... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-54756/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner