CVEvulnerability

CVE-2026-33560

8.4 HIGH Published 2026-06-26 Modified 2026-07-06 Official page ↗
Status
Analyzed
Published
2026-06-26
Last modified
2026-07-06
Assigner
[email protected]
CVSS 4.0 ([email protected])
8.4 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434

Description

The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and scripts to be accepted and written directly to the server.

Affected configurations

• daktronics dmp-5000 firmware (< 8.117.0.0) • daktronics dmp-5000 firmware (>= 9.0.0.0 < 9.43.0.0) • daktronics dmp-5000 firmware (>= 10.0.0.0 < 10.34.0.0) • daktronics dmp-8000 firmware (< 8.117.0.0) • daktronics dmp-8000 firmware (>= 9.0.0.0 < 9.43.0.0) • daktronics dmp-8000 firmware (>= 10.0.0.0 < 10.34.0.0) • daktronics vfc-dmp-5000 firmware (< 8.117.0.0) • daktronics vfc-dmp-5000 firmware (>= 9.0.0.0 < 9.43.0.0) • daktronics vfc-dmp-5000 firmware (>= 10.0.0.0 < 10.34.0.0)

Related

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References