/ Security Architecture /

Yes — most of it can, and some of it regularly is. The attack surface on a typical signage player is the general-purpose OS underneath it: an Android or Windows device inherits an app framework, a browser, USB storage drivers and shell access, and every one of those is a way in. Documented incidents almost always come through that surface or through a weak CMS password, not through some exotic zero-day. SpinetiX DSOS removes the surface rather than guarding it: no app store, no browser stack, no shell, no USB mass-storage drivers, and only cryptographically-signed firmware will execute — which is why DSOS carries a zero-CVE record since 2007.

Nothing. DSOS ships no USB mass-storage drivers — USB ports accept HID devices (keyboard and mouse) only. You cannot load firmware, inject code, or copy data off the device with a USB stick, even holding the player in your hand. This matters because USB is one of the most commonly documented signage infection routes: a technician updates content from an infected stick and the player is compromised. On DSOS that vector does not exist to be exploited.

Yes — media players belong on a dedicated VLAN, isolated from workstations and servers, with default-deny firewall rules. If a player is ever compromised, segmentation is what stops it becoming lateral movement into corporate infrastructure. SpinetiX makes the rules trivial: players need only two port ranges — 80/443 for management and 81/9802 for content publishing — so everything else can be denied. Segmentation is one layer, though, not the whole answer: a compromised player on a VLAN can still reach out over port 443, which is why the OS underneath has to be hardened too.

Quarterly, with CVE-detailed release notes and published security advisories for every firmware release. That cadence is the point of comparison: on heterogeneous SoC signage estates, platform updates often arrive only every one to two years, which is how fleets end up permanently unpatched and become the soft entry point into the wider network. A single hardened OS across the fleet is what makes a quarterly cycle realistic to actually apply.

No. DSOS is built on Yocto Linux stripped to bare minimum — no Java runtime, no OpenSSL heartbeat extension, no pipe primitives. SpinetiX publishes CVE-detailed security advisories for every firmware release.

None is exploitable on a properly-deployed DSOS fleet. CVE-2026-31431 (Copy Fail) is a local privilege escalation in the AF_ALG kernel API; DSOS exposes no shell, no SSH, no interactive login, and no path through which a remote actor can load and execute native code, so the local-execution precondition the exploit requires is structurally absent. Internal Linux service UIDs and Control Center auth credentials exist, but none of them maps to a remote-execution surface. Both JavaScript engines on the device — V8 inside the HTML renderer (Chromium Embedded Framework) and the JavaScript engine in the SVG renderer where Elementi project JS runs — are unable to reach AF_ALG, and the cryptographic primitives DSOS uses do not route through the kernel crypto API. The patched kernel ships in the next minor DSOS firmware release across affected models (all DSOS hardware except HMP3xx and DiVA, which were never affected). CVE-2026-43284 (Dirty Frag) is in kernel modules SpinetiX does not compile into DSOS — the vulnerable code is simply not present on the device. CVE-2026-46300 (Fragnesia) is in the IPsec and RxRPC modules (esp4, esp6, rxrpc, ipcomp4, ipcomp6) — also not compiled into DSOS. The SpinetiX cloud (Arya, HUB, Control Center cloud) runs serverless on AWS with the video-conversion platform on SpinetiX-managed EC2; AWS confirmed via security bulletins AWS-2026-029 / AWS-2026-030 that its infrastructure is also unaffected by Fragnesia, for the same architectural reason. Media La Vista tracks every kernel CVE with potential reach into the deployed estate; impact analysis is cross-verified with SpinetiX engineering. See the full write-up at /cybersecurity-is-a-discipline-not-a-feature/.

No. DSOS only executes SpinetiX-signed firmware. Unsigned code will not install. There are no USB drivers (only HID), no shell access, no user-controlled processes. The OS cannot be changed, replaced, or extended.

Yes to both. The entire stack — Elementi software + SpinetiX players — runs 100% on-premises inside your corporate network, zero data leaves your building, and full air-gap operation is supported for defense, government, and classified environments. DSOS is a closed, purpose-built Linux derivative with signed firmware, role-based access, encrypted media transport and audit logging — the building blocks regional frameworks ask for, including NESA and TDRA standards in the UAE, NCA ECC in Saudi Arabia, and Qatar's NIA Policy v2. SpinetiX is Swiss, a neutral jurisdiction, which is increasingly a procurement criterion in its own right.

Arya Cloud is certified ISO/IEC 27001:2013, GDPR compliant, and BSI C5 attested. On the device side the controls are architectural rather than certificate-based: TPM 2.0 and UEFI Secure Boot in hardware, cryptographically-signed firmware, and HTTPS enforced by default since firmware 4.3.0. That distinction is worth understanding — cloud certifications audit the vendor's management system, not the operating system running on the player, which is why an estate can hold clean certifications and still run unpatched players. Ask about the player OS separately from the paperwork.

Android and Windows players inherit thousands of CVEs from their consumer-grade OS. SpinetiX DSOS is purpose-built for signage only — no app store, no browser, no attack surface. 0.4% failure rate over 10 years vs. typical 15–30% on consumer platforms.