Daktronics display controllers expose root access via default creds
Three vulnerabilities in Daktronics DMP/VFC display controllers allow unauthenticated attackers to gain root-level access through default credentials, path traversal, and unrestricted file upload.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has published an advisory detailing three vulnerabilities in Daktronics Controller Firmware affecting VFC-DMP-5000, DMP-5000, and DMP-8000 devices deployed across commercial facilities, healthcare, emergency services, and IT sectors worldwide. The vulnerabilities include a path traversal flaw (CVE-2026-28701) allowing directory escape and file system enumeration, an unrestricted file upload weakness (CVE-2026-33560) permitting authenticated users to upload arbitrary executables, and hardcoded default credentials (CVE-2026-31928) that are not required to be changed during setup. Combined, these flaws could allow an unauthenticated attacker to achieve complete root-level system control.
Daktronics has released patches in firmware versions 8.117.0.x, 9.43.0.x, and 10.34.0.x to address the vulnerabilities. The vendor strongly recommends updating default passwords and implementing unique, strong credentials per device. CISA advises organizations to minimize network exposure for affected devices, isolate them behind firewalls, and use secure remote access methods like VPNs. No public exploitation has been reported to CISA at the time of the advisory's publication. The vulnerabilities were discovered and reported by Thomas Jou of Princeton University.
Mentioned in this report
Detection guidance
Path Traversal Attempt Against Embedded Web Management Interface
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests containing directory traversal sequences targeting web-managed embedded/controller interfaces, consistent with CVE-2026-28701-style path traversal used for file system enumeration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Path Traversal Attempt Against Embedded Web Management Interface
id: 7778e90a-19e1-5aed-8fe4-24eb123c5f53
status: experimental
description: 'Detects HTTP requests with directory traversal sequences (../ or encoded
equivalents) sent to embedded device web management interfaces, matching the pattern
used to escape restricted directories and enumerate the filesystem as described
in CVE-2026-28701 affecting Daktronics controllers.
'
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains:
- ../
- ..%2f
- ..%2F
- '%2e%2e%2f'
- '%2e%2e/'
filter_static_assets:
cs-uri-stem|contains:
- /static/
- /assets/
condition: selection and not filter_static_assets
fields:
- c-ip
- cs-uri-stem
- cs-method
- cs-user-agent
falsepositives:
- Web application vulnerability scanners or penetration testing tools intentionally
probing for traversal
- Poorly encoded but benign query parameters containing literal dot sequences
level: medium
tags:
- attack.t1083
- attack.discovery
author: Vorant
Executable File Upload to Embedded Device Web Interface
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP POST/PUT requests uploading executable or firmware-like binary content to an embedded controller's web interface, consistent with unrestricted file upload abuse (CVE-2026-33560) to transfer attacker tooling. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Executable File Upload to Embedded Device Web Interface
id: 4d01bfe9-5216-5ac2-9a21-e3e229b637c7
status: experimental
description: 'Detects file upload HTTP requests to device management endpoints where
the uploaded filename or content-type indicates an executable or firmware binary,
matching the unrestricted file upload behavior described in CVE-2026-33560 that
allows authenticated users to plant arbitrary executables on Daktronics controllers.
'
logsource:
category: webserver
detection:
selection_method:
cs-method:
- POST
- PUT
selection_upload_path:
cs-uri-stem|contains:
- upload
- firmware
- update
selection_binary_indicator:
cs-uri-stem|contains:
- .exe
- .bin
- .sh
- .elf
- .img
condition: selection_method and selection_upload_path and selection_binary_indicator
fields:
- c-ip
- cs-uri-stem
- cs-method
- cs-user-agent
falsepositives:
- Legitimate firmware update operations performed by administrators through the vendor-approved
update workflow
- Automated device management/orchestration tools pushing signed firmware images
level: high
tags:
- attack.t1105
- attack.command-and-control
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs