CVE-2025-12049 is a critical missing authentication flaw in the Sharp Display Solutions MP-01 media player, all versions, scored 9.8. The web interface can be used without logging in. Sharp's advisory lists no fixed version, only a workaround: use it on a firewalled intranet and never connect it to the internet.
What's affected
The NVD record and Sharp's advisory both name the Sharp Display Solutions media player MP-01, and the record says all versions are affected.
Sharp's advisory describes two consequences. An attacker could execute arbitrary commands or programs, and could deliver arbitrary content from the authoring software to the player. NVD's description adds that the attacker could reach the web interface without authentication and change settings or perform other operations.
On fixes: the Sharp page lists a workaround and no patched version. If a firmware update appears later, it will be on the vendor's support page, so check there before you plan around the workaround alone.
How to check if you're exposed
Because all versions are affected, the question is not which version you run but how reachable the player is.
- Find every MP-01 you operate. These players tend to sit behind signage and displays in lobbies, shops and meeting rooms, where nobody thinks of them as IT assets.
- Check the network each one is on. Sharp's workaround is a safe intranet protected by a firewall with no internet connection, so any player that is on a flat office network, a guest network or a port forward fails that test.
- From a normal workstation, open the player's address in a browser. If it shows a management page without asking for a login, the exposure is real.
- Search your firewall rules for forwards or public addresses pointing to these players.
What to do now
- Follow Sharp's workaround. Use the product only on a safe intranet protected by a firewall and do not connect it to the internet.
- Move the players to their own VLAN or network segment, and allow access only from the hosts that run the authoring software and your admin workstation.
- Remove any port forwards or public IP addresses that lead to them.
- Review the content on the players. If someone could deliver content without logging in, check that what is playing is what you meant to publish.
- Watch Sharp's support page for a firmware release and note the date you checked. Plan to replace the players if the vendor does not ship a fix.
Why it matters
The weakness is CWE-306, missing authentication for a critical function. Nothing stands between a person on the network and the actions the web interface offers. That is a design gap, so there is nothing to tune or harden around it except network controls.
Signage players are a quiet risk. They are usually installed once and left, they often have display access to public spaces, and their content is the first thing visitors see. Changing what they show is an obvious route to reputational harm, and the command execution described in the advisory goes further.
The record does not mark this CVE as exploited and it is not in the CISA Known Exploited Vulnerabilities catalog. The Sharp page includes an acknowledgement to the reporter, which tells you it came through coordinated reporting.
Quick check
Is there a patch for the MP-01?
Sharp's advisory lists a workaround and no fixed version. Check Sharp's support page for updates.
Is the workaround enough?
It stops people outside your network from reaching the player. It does not help against someone on the same network, so segment the players as well.
Sources
Last reviewed: 19 October 2026.
