CVE-2026-33560

The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and scripts to be accepted and written directly to the server.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-04.json	Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:daktronics:dmp-5000_firmware::::::::
	cpe:2.3:o:daktronics:dmp-5000_firmware::::::::
	cpe:2.3:o:daktronics:dmp-5000_firmware::::::::

cpe:2.3:h:daktronics:dmp-5000:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

OR	cpe:2.3:o:daktronics:dmp-8000_firmware::::::::
	cpe:2.3:o:daktronics:dmp-8000_firmware::::::::
	cpe:2.3:o:daktronics:dmp-8000_firmware::::::::

cpe:2.3:h:daktronics:dmp-8000:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

OR	cpe:2.3:o:daktronics:vfc-dmp-5000_firmware::::::::
	cpe:2.3:o:daktronics:vfc-dmp-5000_firmware::::::::
	cpe:2.3:o:daktronics:vfc-dmp-5000_firmware::::::::

cpe:2.3:h:daktronics:vfc-dmp-5000:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-26 23:17

Updated : 2026-07-06 17:53

NVD link : CVE-2026-33560

Mitre link : CVE-2026-33560

CVE.ORG link : CVE-2026-33560

JSON object : View

Products Affected

daktronics

dmp-8000
dmp-5000
vfc-dmp-5000_firmware
dmp-5000_firmware
vfc-dmp-5000
dmp-8000_firmware

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2026-33560", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33560", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-29T13:15:11.887639Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ics-cert@hq.dhs.gov", "affectedData": [{"vendor": "Daktronics", "product": "VFC-DMP-5000", "versions": [{"status": "affected", "version": "0", "lessThan": "v8.117.x.x", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "v9.43.x.x", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "v10.34.x.x", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Daktronics", "product": "DMP-5000", "versions": [{"status": "affected", "version": "0", "lessThan": "v10.34.x.x", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "v8.117.x.x", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "v9.43.x.x", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Daktronics", "product": "DMP-8000", "versions": [{"status": "affected", "version": "0", "lessThan": "v10.34.x.x", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "v8.117.x.x", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "v9.43.x.x", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-26T23:17:08.847", "references": [{"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-04.json", "tags": ["Third Party Advisory"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and scripts to be accepted and written directly to the server."}], "lastModified": "2026-07-06T17:53:59.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:daktronics:dmp-5000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC827F44-DDD5-473A-A5A4-5F1A9DB599E1", "versionEndExcluding": "8.117.0.0"}, {"criteria": "cpe:2.3:o:daktronics:dmp-5000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2321C24B-44E9-4F30-9EF5-C62CD504B417", "versionEndExcluding": "9.43.0.0", "versionStartIncluding": "9.0.0.0"}, {"criteria": "cpe:2.3:o:daktronics:dmp-5000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4723D54B-7328-4B23-B3E0-2E3D39175E94", "versionEndExcluding": "10.34.0.0", "versionStartIncluding": "10.0.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:daktronics:dmp-5000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CCDE1383-03A5-4D58-AFE1-258F3A68F139"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:daktronics:dmp-8000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4CD80BE2-02B2-4B3F-8594-C54735481C20", "versionEndExcluding": "8.117.0.0"}, {"criteria": "cpe:2.3:o:daktronics:dmp-8000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "855F02E7-94B5-4F6B-88C9-3B66CCF40D9A", "versionEndExcluding": "9.43.0.0", "versionStartIncluding": "9.0.0.0"}, {"criteria": "cpe:2.3:o:daktronics:dmp-8000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65F10110-5A9A-4108-9758-F617897AF86C", "versionEndExcluding": "10.34.0.0", "versionStartIncluding": "10.0.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:daktronics:dmp-8000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "230CC60C-0D0B-48AC-86AA-1833FF480D85"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:daktronics:vfc-dmp-5000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4D7C7AB-A77B-409E-9FCA-39C64E7BE560", "versionEndExcluding": "8.117.0.0"}, {"criteria": "cpe:2.3:o:daktronics:vfc-dmp-5000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "611C2569-E5F4-4A10-A9BD-1E2A25204DB3", "versionEndExcluding": "9.43.0.0", "versionStartIncluding": "9.0.0.0"}, {"criteria": "cpe:2.3:o:daktronics:vfc-dmp-5000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B283008-0F91-4B28-9A31-D08714BFCE73", "versionEndExcluding": "10.34.0.0", "versionStartIncluding": "10.0.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:daktronics:vfc-dmp-5000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AF83B441-585B-4D64-A173-3BBA85318708"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}