# CVE-2026-33560: Daktronics DMP-5000 Unrestricted File Upload

Source: https://junglewise.ai/threats/cve-2026-33560-daktronics-dmp-5000-unrestricted-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-33560 · Severity: high · CVSS 7.1 · Published 2026-06-26

Daktronics DMP-5000 and DMP-8000 controllers, which are used to manage digital displays and signage, contain a security flaw in their file service. An authenticated user can upload any type of file, including malicious scripts or executable programs, directly to the server. This could allow an attacker to gain unauthorized control over the display system, potentially leading to the broadcast of unauthorized content or further network intrusion.

Technologies: [Daktronics DMP-5000](https://junglewise.ai/threats/technologies/dmp-5000), [Daktronics DMP-8000](https://junglewise.ai/threats/technologies/dmp-8000), [Daktronics VFC-DMP-5000](https://junglewise.ai/threats/technologies/vfc-dmp-5000). Vendors: [Daktronics](https://junglewise.ai/threats/vendors/daktronics).

## Quick answers

**Is CVE-2026-33560 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33560 being exploited in the wild.

**How severe is CVE-2026-33560?** High severity, with a CVSS score of 7.1, published 26 June 2026.

**Which products and versions are affected?** Daktronics DMP-5000 < v8.117.x.x, < v9.43.x.x, < v10.34.x.x; Daktronics DMP-8000 < v8.117.x.x, < v9.43.x.x, < v10.34.x.x; Daktronics VFC-DMP-5000 < v8.117.x.x, < v9.43.x.x, < v10.34.x.x.

**Is there a fix for CVE-2026-33560?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-33560 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-33560?** Check whether you run Daktronics DMP-5000, Daktronics DMP-8000 or Daktronics VFC-DMP-5000 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as Unrestricted Upload of File with Dangerous Type (CWE-434) within the DMP-5000 file service component. Exposed endpoints allow authenticated users to upload files of any type without extension filtering or content inspection. This allows executable binaries and scripts to be written directly to the server's filesystem. While authentication is required, the vulnerability can be combined with other issues like default credentials to achieve significant impact. Daktronics recommends updating firmware to versions 8.117.0.x, 9.43.0.x, or 10.34.0.x depending on the product configuration.

## Affected products

- Daktronics VFC-DMP-5000 < v8.117.x.x, < v9.43.x.x, < v10.34.x.x
- Daktronics DMP-5000 < v8.117.x.x, < v9.43.x.x, < v10.34.x.x
- Daktronics DMP-8000 < v8.117.x.x, < v9.43.x.x, < v10.34.x.x

## Timeline

- 2026-06-25: advisory: Initial publication by CISA (ICSA-26-176-04)
- 2026-06-26: disclosed: NVD publication date

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-04.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-04.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04](https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04)

## Related threats

- [Daktronics DMP-5000 hard-coded default credentials](https://junglewise.ai/threats/cve-2026-31928-daktronics-dmp-5000-hard-coded-default-credentials)
- [Daktronics Controller Firmware path traversal](https://junglewise.ai/threats/cve-2026-28701-daktronics-controller-firmware-path-traversal)