Which versions of Daktronics DMP are affected by CVE-2026-28701?

Daktronics display media players (VFC-DMP-5000, DMP-5000, DMP-8000) contain a critical path traversal vulnerability (CVSS 9.3) permitting unauthenticated, remote reconnaissance of device internals…

How to fix or mitigate CVE-2026-28701?

Within 24 hours: Conduct complete inventory of VFC-DMP-5000, DMP-5000, and DMP-8000 systems; document network topology and data flow. Within 7 days: Implement Layer 2/3 network segmentation isolating affected systems to a dedicated VLAN; deploy firewall access control lists restricting inbound connections to authorized management hosts only; disable remote management protocols and external network access where operationally feasible. Within 30 days: Establish vendor contact with Daktronics to obtain patched firmware release date and security advisory; monitor CISA notifications continuously; evaluate temporary shutdown or air-gapping of non-critical systems if patch availability extends beyond 60 days.

Daktronics DMP CVE-2026-28701

Q: What is the CVSS score of CVE-2026-28701?

CVE-2026-28701 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-39923 CRITICAL

Path Traversal (CWE-22)

2026-06-26 icscert

GHSA-qr6g-wmfj-4xhv

Path Traversal Vfc Dmp 5000 Dmp 5000 Dmp 8000 Daktronics

9.3

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-reachable, low-complexity, unauthenticated (PR:N) traversal; description supports only path enumeration (C:L) with no integrity or availability impact, unlike the input's VI:H/VA:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 26, 2026 - 23:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 26, 2026 - 23:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 26, 2026 - 23:22 vuln.today

cvss_changed

CVSS changed

Jun 26, 2026 - 23:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Jun 26, 2026 - 23:15 vuln.today

DescriptionCVE.org

Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate arbitrary file system paths.

AnalysisAI

Path traversal in Daktronics Controller Firmware for the VFC-DMP-5000, DMP-5000, and DMP-8000 display media players lets remote users break out of the intended directory and enumerate arbitrary file system paths, exposing the device's internal layout to attackers. Both authenticated and unauthenticated requests are accepted, and the flaw is reachable over the network with no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, though the issue was reported through ICS-CERT and carries a CVSS 4.0 base score of 9.3.

Technical ContextAI

Daktronics DMP (Display Media Player) controllers are embedded OT/digital-signage appliances that drive large-format LED scoreboards and video displays, typically exposing an HTTP-based management/content interface. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal): the firmware fails to canonicalize or constrain user-supplied path input, so traversal sequences (such as ../) reach locations outside the web root. The affected CPEs are cpe:2.3:a:daktronics:vfc-dmp-5000, cpe:2.3:a:daktronics:dmp-5000, and cpe:2.3:a:daktronics:dmp-8000, all listed at unspecified ('*') versions, indicating multiple firmware revisions are in scope.

RemediationAI

No vendor-released patch version is identified in the available data; consult the CISA ICS advisory icsa-26-176-04 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04) and the corresponding CSAF document for the specific fixed firmware build and apply it once published. Because these are network-reachable OT display controllers, the most effective compensating control is to remove the management interface from internet and untrusted-network exposure: place the DMP-5000/DMP-8000/VFC-DMP-5000 devices on an isolated signage VLAN, restrict access to the HTTP management port via firewall allow-lists to known administrative hosts only (trade-off: remote content updates must then originate from inside that segment), and front the interface with a reverse proxy or WAF rule that normalizes and rejects path-traversal sequences (trade-off: may break legitimate URLs that contain encoded path characters). Following CISA ICS guidance, also avoid direct internet exposure and use VPN-gated access for any remote administration.