Which versions of Daktronics DMP-5000 are affected by CVE-2026-31928?

Daktronics digital media players (DMP-5000, VFC-DMP-5000, DMP-8000) cannot change factory-default administrative credentials, creating a critical vulnerability where any network-accessible device is…

How to fix or mitigate CVE-2026-31928?

24 hours: Manually change default administrative credentials to unique, complex passwords on all Daktronics DMP devices; implement network firewall rules restricting administrative interface access to authorized administrative subnets only. 7 days: Conduct complete inventory of all affected Daktronics devices (DMP-5000, VFC-DMP-5000, DMP-8000); review administrative access logs for anomalous activity; network-segment device management interfaces away from general user networks. 30 days: Contact Daktronics to obtain patch status and supported remediation options; evaluate device replacement or alternative media player solutions; implement continuous network monitoring for suspicious administrative access patterns.

Daktronics DMP-5000 CVE-2026-31928

Q: What is the CVSS score of CVE-2026-31928?

CVE-2026-31928 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-39925 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-06-26 icscert

GHSA-rf2w-j7p7-rw94

Authentication Bypass Vfc Dmp 5000 Dmp 5000 Dmp 8000 Daktronics

9.3

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

9.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Default credentials are publicly known so the auth barrier is effectively absent (PR:N) over a low-complexity network web interface, and full admin access compromises device confidentiality, integrity, and availability.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 23:31 vuln.today

Severity Changed

Jun 26, 2026 - 23:22 NVD

HIGH CRITICAL

CVSS changed

Jun 26, 2026 - 23:22 NVD

8.1 (HIGH) 9.3 (CRITICAL)

DescriptionCVE.org

The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed during initial configuration or operation. Using these accounts provides full system access.

AnalysisAI

Default administrative web credentials in Daktronics DMP-5000, VFC-DMP-5000, and DMP-8000 digital media players grant full system access to anyone who knows the shipped account, because the devices do not force a credential change during setup or operation. Tracked as CWE-798 (use of hard-coded/default credentials) and rated CVSS 4.0 9.3 by ICS-CERT, this lets a network-positioned attacker log into the management interface and seize complete control of the device. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but default-credential weaknesses are trivially abused once the device is reachable.

Technical ContextAI

The affected products are Daktronics DMP (Digital Media Player) and VFC-DMP series controllers used to drive large-format LED video displays and digital signage in stadiums, transportation, and commercial venues (CPEs cpe:2.3:a:daktronics:vfc-dmp-5000, cpe:2.3:a:daktronics:dmp-5000, and cpe:2.3:a:daktronics:dmp-8000). The root cause is CWE-798, Use of Hard-coded/Default Credentials: the firmware ships with a built-in administrative web account whose password is not enforced to be changed at first boot or thereafter. Because the credential is a known constant baked into the product rather than a per-device secret, the authentication control protecting the web management plane is effectively non-existent for anyone who knows or can look up the default. This is a classic OT/ICS device-hardening failure where management interfaces are exposed without mandatory credential rotation.

RemediationAI

No vendor-released patch version is identified at time of analysis, so remediation centers on credential hygiene and network controls: immediately change the default administrative web account password to a strong unique value on every DMP-5000, VFC-DMP-5000, and DMP-8000 unit, and disable or rename the default account if the firmware permits. As compensating controls, place these media players on an isolated OT/management VLAN and block access to the web management interface from corporate and internet zones using firewall ACLs (side effect: legitimate remote management must then traverse a jump host or VPN); restrict management access to a small allowlist of administrative IPs; and require VPN for any remote operation. Monitor the management interface for logins using the default account. Follow the mitigation and any patch guidance in CISA advisory ICSA-26-176-04 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04) and the CSAF file (https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-04.json), and contact Daktronics for firmware that enforces credential changes.