Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
3 vulnerabilities by Daktronics
CVE-2026-31928 (GCVE-0-2026-31928)
Vulnerability from cvelistv5 – Published: 2026-06-26 22:52 – Updated: 2026-06-26 22:52
VLAI
Title
Daktronics Controller Firmware Use of Hard-coded Credentials
Summary
The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed during initial configuration or operation. Using these accounts provides full system access.
Severity
8.1 (High)
CWE
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Daktronics | VFC-DMP-5000 |
Affected:
0 , < v8.117.x.x
(custom)
Affected: 0 , < v9.43.x.x (custom) Affected: 0 , < v10.34.x.x (custom) |
|
| Daktronics | DMP-5000 |
Affected:
0 , < v10.34.x.x
(custom)
Affected: 0 , < v8.117.x.x (custom) Affected: 0 , < v9.43.x.x (custom) |
|
| Daktronics | DMP-8000 |
Affected:
0 , < v10.34.x.x
(custom)
Affected: 0 , < v8.117.x.x (custom) Affected: 0 , < v9.43.x.x (custom) |
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VFC-DMP-5000",
"vendor": "Daktronics",
"versions": [
{
"lessThan": "v8.117.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "v9.43.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "v10.34.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DMP-5000",
"vendor": "Daktronics",
"versions": [
{
"lessThan": "v10.34.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "v8.117.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "v9.43.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DMP-8000",
"vendor": "Daktronics",
"versions": [
{
"lessThan": "v10.34.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "v8.117.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "v9.43.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Thomas Jou of Princeton University reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eThe DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed during initial configuration or operation. Using these accounts provides full system access.\u003c/span\u003e"
}
],
"value": "The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed during initial configuration or operation. Using these accounts provides full system access."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T22:52:51.074Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-04.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eDaktronics recommends users update their device software to one of the following versions (based on product configuration in use): 8.117.0.x, 9.43.0.x, or 10.34.0.x\u003c/span\u003e"
}
],
"value": "Daktronics recommends users update their device software to one of the following versions (based on product configuration in use): 8.117.0.x, 9.43.0.x, or 10.34.0.x"
}
],
"source": {
"advisory": "ICSA-26-176-04",
"discovery": "EXTERNAL"
},
"title": "Daktronics Controller Firmware Use of Hard-coded Credentials",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eDaktronics recommends updating the default passwords and encourages using strong, unique credentials per device.\u003c/span\u003e"
}
],
"value": "Daktronics recommends updating the default passwords and encourages using strong, unique credentials per device."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-31928",
"datePublished": "2026-06-26T22:52:51.074Z",
"dateReserved": "2026-03-30T20:11:42.808Z",
"dateUpdated": "2026-06-26T22:52:51.074Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33560 (GCVE-0-2026-33560)
Vulnerability from cvelistv5 – Published: 2026-06-26 22:48 – Updated: 2026-06-26 22:48
VLAI
Title
Daktronics Controller Firmware Unrestricted Upload of File with Dangerous Type
Summary
The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and scripts to be accepted and written directly to the server.
Severity
CWE
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Daktronics | VFC-DMP-5000 |
Affected:
0 , < v8.117.x.x
(custom)
Affected: 0 , < v9.43.x.x (custom) Affected: 0 , < v10.34.x.x (custom) |
|
| Daktronics | DMP-5000 |
Affected:
0 , < v10.34.x.x
(custom)
Affected: 0 , < v8.117.x.x (custom) Affected: 0 , < v9.43.x.x (custom) |
|
| Daktronics | DMP-8000 |
Affected:
0 , < v10.34.x.x
(custom)
Affected: 0 , < v8.117.x.x (custom) Affected: 0 , < v9.43.x.x (custom) |
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VFC-DMP-5000",
"vendor": "Daktronics",
"versions": [
{
"lessThan": "v8.117.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "v9.43.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "v10.34.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DMP-5000",
"vendor": "Daktronics",
"versions": [
{
"lessThan": "v10.34.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "v8.117.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "v9.43.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DMP-8000",
"vendor": "Daktronics",
"versions": [
{
"lessThan": "v10.34.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "v8.117.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "v9.43.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Thomas Jou of Princeton University reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eThe DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and scripts to be accepted and written directly to the server.\u003c/span\u003e"
}
],
"value": "The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and scripts to be accepted and written directly to the server."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T22:48:56.236Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-04.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eDaktronics recommends users update their device software to one of the following versions (based on product configuration in use): 8.117.0.x, 9.43.0.x, or 10.34.0.x\u003c/span\u003e"
}
],
"value": "Daktronics recommends users update their device software to one of the following versions (based on product configuration in use): 8.117.0.x, 9.43.0.x, or 10.34.0.x"
}
],
"source": {
"advisory": "ICSA-26-176-04",
"discovery": "EXTERNAL"
},
"title": "Daktronics Controller Firmware Unrestricted Upload of File with Dangerous Type",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eDaktronics recommends updating the default passwords and encourages using strong, unique credentials per device.\u003c/span\u003e"
}
],
"value": "Daktronics recommends updating the default passwords and encourages using strong, unique credentials per device."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-33560",
"datePublished": "2026-06-26T22:48:56.236Z",
"dateReserved": "2026-03-30T20:11:42.801Z",
"dateUpdated": "2026-06-26T22:48:56.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28701 (GCVE-0-2026-28701)
Vulnerability from cvelistv5 – Published: 2026-06-26 22:40 – Updated: 2026-06-26 23:03
VLAI
Title
Daktronics Controller Firmware Path Traversal
Summary
Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate arbitrary file system paths.
Severity
9.8 (Critical)
CWE
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Daktronics | VFC-DMP-5000 |
Affected:
0 , < v8.117.x.x
(custom)
Affected: 0 , < v9.43.x.x (custom) Affected: 0 , < v10.34.x.x (custom) |
|
| Daktronics | DMP-5000 |
Affected:
0 , < v10.34.x.x
(custom)
Affected: 0 , < v8.117.x.x (custom) Affected: 0 , < v9.43.x.x (custom) |
|
| Daktronics | DMP-8000 |
Affected:
0 , < v10.34.x.x
(custom)
Affected: 0 , < v8.117.x.x (custom) Affected: 0 , < v9.43.x.x (custom) |
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VFC-DMP-5000",
"vendor": "Daktronics",
"versions": [
{
"lessThan": "v8.117.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "v9.43.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "v10.34.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DMP-5000",
"vendor": "Daktronics",
"versions": [
{
"lessThan": "v10.34.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "v8.117.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "v9.43.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DMP-8000",
"vendor": "Daktronics",
"versions": [
{
"lessThan": "v10.34.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "v8.117.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "v9.43.x.x",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Thomas Jou of Princeton University reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eVarious versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate arbitrary file system paths.\u003c/span\u003e"
}
],
"value": "Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate arbitrary file system paths."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T23:03:12.487Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-04.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eDaktronics recommends users update their device software to one of the following versions (based on product configuration in use): 8.117.0.x, 9.43.0.x, or 10.34.0.x\u003c/span\u003e"
}
],
"value": "Daktronics recommends users update their device software to one of the following versions (based on product configuration in use): 8.117.0.x, 9.43.0.x, or 10.34.0.x"
}
],
"source": {
"advisory": "ICSA-26-176-04",
"discovery": "EXTERNAL"
},
"title": "Daktronics Controller Firmware Path Traversal",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eDaktronics recommends updating the default passwords and encourages using strong, unique credentials per device.\u003c/span\u003e"
}
],
"value": "Daktronics recommends updating the default passwords and encourages using strong, unique credentials per device."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-28701",
"datePublished": "2026-06-26T22:40:03.058Z",
"dateReserved": "2026-03-30T20:11:42.786Z",
"dateUpdated": "2026-06-26T23:03:12.487Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}