CVE-2026-31928

The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed during initial configuration or operation. Using these accounts provides full system access.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-04.json	Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:daktronics:dmp-5000_firmware::::::::
	cpe:2.3:o:daktronics:dmp-5000_firmware::::::::
	cpe:2.3:o:daktronics:dmp-5000_firmware::::::::

cpe:2.3:h:daktronics:dmp-5000:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

OR	cpe:2.3:o:daktronics:dmp-8000_firmware::::::::
	cpe:2.3:o:daktronics:dmp-8000_firmware::::::::
	cpe:2.3:o:daktronics:dmp-8000_firmware::::::::

cpe:2.3:h:daktronics:dmp-8000:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

OR	cpe:2.3:o:daktronics:vfc-dmp-5000_firmware::::::::
	cpe:2.3:o:daktronics:vfc-dmp-5000_firmware::::::::
	cpe:2.3:o:daktronics:vfc-dmp-5000_firmware::::::::

cpe:2.3:h:daktronics:vfc-dmp-5000:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-26 23:17

Updated : 2026-07-06 17:58

NVD link : CVE-2026-31928

Mitre link : CVE-2026-31928

CVE.ORG link : CVE-2026-31928

JSON object : View

Products Affected

daktronics

dmp-8000
dmp-5000
vfc-dmp-5000_firmware
dmp-5000_firmware
vfc-dmp-5000
dmp-8000_firmware

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2026-31928", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31928", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-29T13:56:45.915219Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ics-cert@hq.dhs.gov", "affectedData": [{"vendor": "Daktronics", "product": "VFC-DMP-5000", "versions": [{"status": "affected", "version": "0", "lessThan": "v8.117.x.x", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "v9.43.x.x", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "v10.34.x.x", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Daktronics", "product": "DMP-5000", "versions": [{"status": "affected", "version": "0", "lessThan": "v10.34.x.x", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "v8.117.x.x", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "v9.43.x.x", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Daktronics", "product": "DMP-8000", "versions": [{"status": "affected", "version": "0", "lessThan": "v10.34.x.x", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "v8.117.x.x", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "v9.43.x.x", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-26T23:17:08.697", "references": [{"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-04.json", "tags": ["Third Party Advisory"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed during initial configuration or operation. Using these accounts provides full system access."}], "lastModified": "2026-07-06T17:58:09.570", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:daktronics:dmp-5000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC827F44-DDD5-473A-A5A4-5F1A9DB599E1", "versionEndExcluding": "8.117.0.0"}, {"criteria": "cpe:2.3:o:daktronics:dmp-5000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2321C24B-44E9-4F30-9EF5-C62CD504B417", "versionEndExcluding": "9.43.0.0", "versionStartIncluding": "9.0.0.0"}, {"criteria": "cpe:2.3:o:daktronics:dmp-5000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4723D54B-7328-4B23-B3E0-2E3D39175E94", "versionEndExcluding": "10.34.0.0", "versionStartIncluding": "10.0.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:daktronics:dmp-5000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CCDE1383-03A5-4D58-AFE1-258F3A68F139"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:daktronics:dmp-8000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4CD80BE2-02B2-4B3F-8594-C54735481C20", "versionEndExcluding": "8.117.0.0"}, {"criteria": "cpe:2.3:o:daktronics:dmp-8000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "855F02E7-94B5-4F6B-88C9-3B66CCF40D9A", "versionEndExcluding": "9.43.0.0", "versionStartIncluding": "9.0.0.0"}, {"criteria": "cpe:2.3:o:daktronics:dmp-8000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65F10110-5A9A-4108-9758-F617897AF86C", "versionEndExcluding": "10.34.0.0", "versionStartIncluding": "10.0.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:daktronics:dmp-8000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "230CC60C-0D0B-48AC-86AA-1833FF480D85"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:daktronics:vfc-dmp-5000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4D7C7AB-A77B-409E-9FCA-39C64E7BE560", "versionEndExcluding": "8.117.0.0"}, {"criteria": "cpe:2.3:o:daktronics:vfc-dmp-5000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "611C2569-E5F4-4A10-A9BD-1E2A25204DB3", "versionEndExcluding": "9.43.0.0", "versionStartIncluding": "9.0.0.0"}, {"criteria": "cpe:2.3:o:daktronics:vfc-dmp-5000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B283008-0F91-4B28-9A31-D08714BFCE73", "versionEndExcluding": "10.34.0.0", "versionStartIncluding": "10.0.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:daktronics:vfc-dmp-5000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AF83B441-585B-4D64-A173-3BBA85318708"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}