What’s Vulnerable › Vulnerabilities

CVE-2026-33560: Daktronics Controller Firmware Unrestricted Upload of File with Dangerous Type

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-26 · updated 2026-07-06
• Weakness: CWE-434

Description

The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and scripts to be accepted and written directly to the server.

Affected products

• Daktronics Dmp-5000 Firmware: before 8.117.0.0; from 9.0.0.0 before 9.43.0.0; from 10.0.0.0 before 10.34.0.0 — fixed in 10.34.0.0, 8.117.0.0, 9.43.0.0
• Daktronics Dmp-8000 Firmware: before 8.117.0.0; from 9.0.0.0 before 9.43.0.0; from 10.0.0.0 before 10.34.0.0 — fixed in 10.34.0.0, 8.117.0.0, 9.43.0.0
• Daktronics Vfc-Dmp-5000 Firmware: before 8.117.0.0; from 9.0.0.0 before 9.43.0.0; from 10.0.0.0 before 10.34.0.0 — fixed in 10.34.0.0, 8.117.0.0, 9.43.0.0

How to fix

Upgrade to a fixed version: Daktronics Dmp-5000 Firmware 10.34.0.0, 8.117.0.0, 9.43.0.0; Daktronics Dmp-8000 Firmware 10.34.0.0, 8.117.0.0, 9.43.0.0; Daktronics Vfc-Dmp-5000 Firmware 10.34.0.0, 8.117.0.0, 9.43.0.0. Check the vendor advisory for mitigations.

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-04.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04

Get alerted when CVE-2026-33560 or the next vulnerability affects your stack