# Daktronics display controllers expose root access via default creds

Published: 2026-06-25 · Severity: high · Sectors: healthcare, infrastructure, technology
Canonical: https://vorant.io/reports/b3bfa8e5-d8fd-5487-ba7c-8c18d4feb596/daktronics-display-controllers-expose-root-access-via-default-creds

> Three vulnerabilities in Daktronics DMP/VFC display controllers allow unauthenticated attackers to gain root-level access through default credentials, path traversal, and unrestricted file upload.

CISA has published an advisory detailing three vulnerabilities in Daktronics Controller Firmware affecting VFC-DMP-5000, DMP-5000, and DMP-8000 devices deployed across commercial facilities, healthcare, emergency services, and IT sectors worldwide. The vulnerabilities include a path traversal flaw (CVE-2026-28701) allowing directory escape and file system enumeration, an unrestricted file upload weakness (CVE-2026-33560) permitting authenticated users to upload arbitrary executables, and hardcoded default credentials (CVE-2026-31928) that are not required to be changed during setup. Combined, these flaws could allow an unauthenticated attacker to achieve complete root-level system control.

Daktronics has released patches in firmware versions 8.117.0.x, 9.43.0.x, and 10.34.0.x to address the vulnerabilities. The vendor strongly recommends updating default passwords and implementing unique, strong credentials per device. CISA advises organizations to minimize network exposure for affected devices, isolate them behind firewalls, and use secure remote access methods like VPNs. No public exploitation has been reported to CISA at the time of the advisory's publication. The vulnerabilities were discovered and reported by Thomas Jou of Princeton University.

## Mentioned in this report

- Vulnerabilities: CVE-2026-28701, CVE-2026-31928, CVE-2026-33560

## Detection guidance (public sample)

### Path Traversal Attempt Against Embedded Web Management Interface

ATT&CK: T1083

Detects HTTP requests containing directory traversal sequences targeting web-managed embedded/controller interfaces, consistent with CVE-2026-28701-style path traversal used for file system enumeration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Path Traversal Attempt Against Embedded Web Management Interface
id: 7778e90a-19e1-5aed-8fe4-24eb123c5f53
status: experimental
description: 'Detects HTTP requests with directory traversal sequences (../ or encoded
  equivalents) sent to embedded device web management interfaces, matching the pattern
  used to escape restricted directories and enumerate the filesystem as described
  in CVE-2026-28701 affecting Daktronics controllers.

  '
logsource:
  category: webserver
  product: webserver
detection:
  selection:
    cs-uri-stem|contains:
    - ../
    - ..%2f
    - ..%2F
    - '%2e%2e%2f'
    - '%2e%2e/'
  filter_static_assets:
    cs-uri-stem|contains:
    - /static/
    - /assets/
  condition: selection and not filter_static_assets
fields:
- c-ip
- cs-uri-stem
- cs-method
- cs-user-agent
falsepositives:
- Web application vulnerability scanners or penetration testing tools intentionally
  probing for traversal
- Poorly encoded but benign query parameters containing literal dot sequences
level: medium
tags:
- attack.t1083
- attack.discovery
author: Vorant
```

### Executable File Upload to Embedded Device Web Interface

ATT&CK: T1105

Detects HTTP POST/PUT requests uploading executable or firmware-like binary content to an embedded controller's web interface, consistent with unrestricted file upload abuse (CVE-2026-33560) to transfer attacker tooling. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Executable File Upload to Embedded Device Web Interface
id: 4d01bfe9-5216-5ac2-9a21-e3e229b637c7
status: experimental
description: 'Detects file upload HTTP requests to device management endpoints where
  the uploaded filename or content-type indicates an executable or firmware binary,
  matching the unrestricted file upload behavior described in CVE-2026-33560 that
  allows authenticated users to plant arbitrary executables on Daktronics controllers.

  '
logsource:
  category: webserver
  product: webserver
detection:
  selection_method:
    cs-method:
    - POST
    - PUT
  selection_upload_path:
    cs-uri-stem|contains:
    - upload
    - firmware
    - update
  selection_binary_indicator:
    cs-uri-stem|contains:
    - .exe
    - .bin
    - .sh
    - .elf
    - .img
  condition: selection_method and selection_upload_path and selection_binary_indicator
fields:
- c-ip
- cs-uri-stem
- cs-method
- cs-user-agent
falsepositives:
- Legitimate firmware update operations performed by administrators through the vendor-approved
  update workflow
- Automated device management/orchestration tools pushing signed firmware images
level: high
tags:
- attack.t1105
- attack.command_and_control
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b3bfa8e5-d8fd-5487-ba7c-8c18d4feb596/daktronics-display-controllers-expose-root-access-via-default-creds.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup