Vulnerability · Published Jun 26, 2026 · Assigned by icscert
CVE-2026-28701Daktronics Controller Firmware Path Traversal
Critical 9.8
In plain English
A critical-severity path traversal in DMP-5000 from Daktronics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.7%top 47.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate arbitrary file system paths.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Daktronics | VFC-DMP-5000 | 0 – before v8.117.x.x0 – before v9.43.x.x0 – before v10.34.x.x |
| Daktronics | DMP-5000 | 0 – before v10.34.x.x0 – before v8.117.x.x0 – before v9.43.x.x |
| Daktronics | DMP-8000 | 0 – before v10.34.x.x0 – before v8.117.x.x0 – before v9.43.x.x |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H