CVE-2025-54756
Published: 12 February 2026
Summary
CVE-2025-54756 is a high-severity Use of Default Credentials (CWE-1392) vulnerability in Brightsign (inferred from references). Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Default Accounts (T1078.001); ranked at the 2.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and IA-5 (Authenticator Management).
Deeper analysis
BrightSign players running BrightSign OS series 4 prior to version 8.5.53.1 or series 5 prior to version 9.0.166 are affected by CVE-2025-54756, a vulnerability involving a default password that is guessable with knowledge of the device information (CWE-1392). This issue has a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
A local attacker with low-complexity access to the device and knowledge of its information can exploit this vulnerability by guessing the default password, requiring no privileges or user interaction. Successful exploitation grants high-level access, enabling full compromise of the device with potential for unauthorized data access, modification, or disruption.
CISA's ICSA-25-126-03 advisory and BrightSign's software downloads page detail mitigations, noting that the latest OS releases address the issue for new installations. Users of existing installations should manually change all default passwords to prevent exploitation.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207245
Vulnerability details
BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 use a default password that is guessable with knowledge of the device information. The latest release fixes this issue for new installations; users of…
more
old installations are encouraged to change all default passwords.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Default guessable password (CWE-1392) directly enables use of default accounts for local authentication and full device compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
IA-5 requires management of authenticators including changing default and guessable passwords to prevent unauthorized access.
AC-2 mandates account management practices such as disabling unnecessary accounts and changing default credentials tied to device information.
SI-2 ensures timely flaw remediation through applying vendor OS updates that eliminate the guessable default password vulnerability.