EUVD-2026-39924
GHSA-j595-prhp-3r49
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable file service with low-complexity upload but requiring low-privilege authentication (PR:L); arbitrary writes give high integrity impact, limited confidentiality, no direct availability loss.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and scripts to be accepted and written directly to the server.
AnalysisAI
Arbitrary file upload in the Daktronics DMP-5000 (and related VFC-DMP-5000 and DMP-8000) media player file service lets authenticated users write files of any type - including executable binaries and scripts - directly to the server with no extension filtering or content inspection. This unrestricted upload (CWE-434) gives a low-privileged operator a path to plant and potentially execute malicious code on these OT digital-media/scoreboard controllers. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
Daktronics DMP-5000/DMP-8000 are digital media player appliances used to drive large-format displays and scoreboards in operational-technology (OT) environments. The flaw is a CWE-434 Unrestricted Upload of File with Dangerous Type: a file service exposes endpoints that accept uploads but enforce neither an allow-list of extensions nor server-side MIME/content inspection, so an authenticated client can store arbitrary content (binaries, scripts) in a server-writable location. The affected products are identified by CPE strings cpe:2.3:a:daktronics:vfc-dmp-5000, cpe:2.3:a:daktronics:dmp-5000, and cpe:2.3:a:daktronics:dmp-8000. The danger of CWE-434 is realized when an uploaded file lands in a path that is later executed or served, converting a storage primitive into code execution.
RemediationAI
Apply the Daktronics-recommended remediation documented in CISA advisory ICSA-26-176-04 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04) and the CSAF file (https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-04.json); no exact fixed version is provided in the available data, so verify the patched build directly from the vendor before deploying. Because exploitation requires network reachability plus authentication, the most effective compensating controls are network-level: place these OT media players on isolated VLANs behind a firewall, block direct access to the file-service endpoints/ports from general and internet-facing networks, and restrict the file-upload endpoints to a small set of trusted management hosts via ACLs (trade-off: legitimate remote content updates must go through those hosts or a jump server). Tighten and rotate file-service credentials and remove unused low-privilege accounts to shrink the PR:L attack surface, and monitor the upload directories for unexpected executable or script files (trade-off: monitoring detects but does not prevent the write). Avoid exposing these devices to the internet entirely, per standard CISA ICS guidance.
More in Vfc Dmp 5000
View allPath traversal in Daktronics Controller Firmware for the VFC-DMP-5000, DMP-5000, and DMP-8000 display media players lets
Default administrative web credentials in Daktronics DMP-5000, VFC-DMP-5000, and DMP-8000 digital media players grant fu
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today