CVE-2026-33560highCWE-434

CVE-2026-33560: high-severity vulnerability in Daktronics DMP-5000

Daktronics Controller Firmware Unrestricted Upload of File with Dangerous Type

Published · Updated

Follow this CVE+ Monitor DMP-5000+ Monitor DMP-8000

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.4epss 0.4%
The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and scripts to be accepted and written directly to the server.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N
Affected products
Daktronics · DMP-5000Daktronics · DMP-8000Daktronics · VFC-DMP-5000
Related CVEs — Daktronics DMP-5000

In the same product, most dangerous first.

CVE-2026-28701CRITICALDaktronics Controller Firmware Path TraversalEPSS 0.7%CVE-2026-31928CRITICALDaktronics Controller Firmware Use of Hard-coded CredentialsEPSS 0.6%