BrightSign Digital Signage (4k242) Directory Traversal Vulnerability

The BrightSign Digital Signage 4k242 is a multimedia playback device from BrightSign USA. A directory traversal vulnerability exists in the BrightSign Digital Signage 4k242 using firmware version 6.2.63 and earlier. An attacker can exploit the vulnerability by sending the 'rp' parameter to the...

BrightSign Digital Signage XSS / Traversal / File Upload

Exploit Title: BrightSign Digital Signage Multiple Vulnerabilities Date: 12/15/17 Exploit Author: [email protected] Vectors: XSS, Directory Traversal, File Modification, Information Leakage The BrightSign Digital Signage 4k242 device Firmware 6.2.63 and below suffers from multiple...

CVE-2017-17738

The BrightSign Digital Signage 4k242 device Firmware 6.2.63 and below allows renaming and modifying files via /tools.html...

CVE-2017-17739

The BrightSign Digital Signage 4k242 device Firmware 6.2.63 and below has directory traversal via the /storage.html rp parameter, allowing an attacker to read or write to files...

CVE-2017-17739

The BrightSign Digital Signage 4k242 device Firmware 6.2.63 and below has directory traversal via the /storage.html rp parameter, allowing an attacker to read or write to files...

Code injection

The BrightSign Digital Signage 4k242 device Firmware 6.2.63 and below has XSS via the REF parameter to /networkdiagnostics.html or /storageinfo.html...

CVE-2017-17739

The CVE-2017-17739 entry concerns BrightSign Digital Signage (4k242) devices with firmware 6.2.63 and earlier. A directory traversal flaw exists in the /storage.html page via the rp parameter, enabling an unauthenticated attacker to read or write files on the device. Connected sources (CNVD-2018-...

CVE-2017-17737

The BrightSign Digital Signage 4k242 device Firmware 6.2.63 and below has XSS via the REF parameter to /networkdiagnostics.html or /storageinfo.html...

CVE-2017-17737

BrightSign Digital Signage (4k242) devices running firmware 6.2.63 and earlier are affected by a Cross-Site Scripting (XSS) vulnerability in the REF parameter of /network_diagnostics.html and /storage_info.html. The issue originates from input not being validated, enabling injection that could le...