A critical remote file inclusion vulnerability in Sony BRAVIA Digital Signage allows unauthenticated attackers to execute arbitrary scripts and hijack sessions.

The application is susceptible to remote file inclusion (CWE-829) via the content material URL parameter. An unauthenticated attacker can supply malicious client-side scripts, such as JavaScript or HTML, to hijack user sessions or modify displayed content.

Successful exploitation allows an attacker to manipulate the visual content displayed on digital signage, which can lead to significant reputational damage or the dissemination of unauthorized information. Furthermore, session hijacking of administrative consoles may grant attackers deeper access to the signage management network. With a CVSS score of 7.5, this high severity vulnerability poses a substantial risk to corporate environments relying on these displays for communication.

Immediate Action: Contact Sony support to determine if a patch or firmware update is available for your specific deployment, as official remediation details remain publicly unconfirmed.

Proactive Monitoring: Review web access logs for suspicious POST requests to the /api/content-creation endpoint, particularly those containing external URLs in the material parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block requests containing suspicious payloads or unauthorized external domains in the content material URL field.

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID: 49186) and Packet Storm.

Given the availability of a functional proof-of-concept, the risk of exploitation is elevated. Administrators should immediately audit their BRAVIA Digital Signage instances and implement strict network access controls to limit exposure of the management interface to trusted internal networks only until a formal vendor patch is verified and applied.