| Expand | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||
|
...
A. The Diagnostic Web Server: The Diagnostic Web Server (DWS) responds to requests sent to the IP address of the player, allowing a user who meets the username and password requirements to retrieve information about the player and send system commands to it (reboot, enter recovery mode, test video resolution, etc.).
...
The Diagnostic Web Server (DWS) is enabled on new players by default: The username is "admin" and the password is the player serial number. You should set a new password to ensure that unauthorized users cannot access the DWS. To change the login credentials or disable the DWS entirely, perform the player setup process.
| Warning |
|---|
ImportantFirmware versions before 6.2.147.9 have a cross-site scripting vulnerability and a permissions issue that allowed authorized users to view hidden storage directories (see this post for full details). These vulnerabilities are catalogued as CVE-2017-17737, -17738, and -17739. We recommend updating to the current version of production firmware to patch these vulnerabilities. |
...
Other network settings that are configurable during the player setup process—such as proxy setup, wireless configuration, DHCP vs. manual IP—do not negatively affect the security of a player.
...
For a full description of all the options in the Unit Setup window, please see the Setting up BrightSign Players section.
...
High Security
Follow these steps during the BrightAuthor unit setup process to ensure the player has a high level of resilience to outside attacks.
...
You can use the Web Inspector to debug webpages on the BrightSign Chromium instance (see the HTML Best Practices page for more details). This tool does not require authentication, so any party on the network can access and alter content on the BrightSign player; therefore, the Web Inspector should be disabled in production environments.
Linux Security
Though the BrightSign application runs on a Linux stack, it is unlikely that conventional Linux malware will be able to infect BrightSign players. A BrightSign player will only execute a firmware image that has been cryptographically signed by BrightSign. Also, during normal operation, the filesystem used on the player is read-only.
...