CVE-2026-28701

Daktronics Controller Firmware Path Traversal

Published Jun 26, 2026 CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Description
Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate arbitrary file system paths.

Remediation

Vendor Solution

Daktronics recommends users update their device software to one of the following versions (based on product configuration in use): 8.117.0.x, 9.43.0.x, or 10.34.0.x


Vendor Workaround

Daktronics recommends updating the default passwords and encourages using strong, unique credentials per device.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Daktronics
Daktronics dmp-5000
Daktronics dmp-8000
Daktronics vfc-dmp-5000
Vendors & Products Daktronics
Daktronics dmp-5000
Daktronics dmp-8000
Daktronics vfc-dmp-5000
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
Title Daktronics Controller Firmware Path Traversa Daktronics Controller Firmware Path Traversal
Type Values Removed Values Added
Description Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate arbitrary file system paths.
Title Daktronics Controller Firmware Path Traversa
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
icscert
Published
Updated
Jun 29, 2026, 1:15 PM
Reserved
Mar 30, 2026, 8:11 PM
Status
Analyzed
Published
Jun 26, 2026, 11:17 PM
Modified
Jul 6, 2026, 5:59 PM