Daktronics VFC-DMP-5000 / DMP-5000 / DMP-8000 authenticated arbitrary file upload in file service

Daktronics VFC-DMP-5000 (and sibling DMP-5000 / DMP-8000) controllers run a file service that accepts uploads from any authenticated session without validating the extension, MIME type, or content. An attacker who can authenticate can drop a binary, shell script, or configuration file straight onto the controller's filesystem — the same filesystem that runs the sign's playback engine. Affected firmware is anything below 8.117.x.x, 9.43.x.x, or 10.34.x.x; vendor fix tracks are 8.117.0.x, 9.43.0.x, and 10.34.0.x depending on hardware revision.

Vendor's HIGH/7.1 rating is *technically* correct — PR:L makes the math come out to 7.1 — but it understates the operational reality. Daktronics' product line has a long, well-documented history of internet-exposed units running default credentials, including the infamous DOT highway-sign hijack cases. 'Authenticated' on a fleet of LED controllers reachable from the open internet is a much thinner gate than 'authenticated' on a hardened enterprise app. We hold the score at 7.1 but warn that the *effective* exploit barrier is closer to MEDIUM-PR than HIGH-PR for any defender who has not rotated factory passwords.

Sources.

1. CISA ICS Advisory ICSA-26-176-04
2. OffSeq Threat Radar — CVE-2026-33560
3. THREATINT CVE record
4. CIRCL Vulnerability-Lookup
5. ISSSource — Daktronics Updates Controller Firmware
6. OWASP — Unrestricted File Upload
7. CISA Known Exploited Vulnerabilities Catalog
8. CWE-434 — Unrestricted Upload of File with Dangerous Type

Run from an auditor workstation with network reach to the controller. Provide the controller hostname/IP, a known-good credential, and an optional firmware-track override. Example: ./check_dmp5000.sh 10.20.30.40 admin 'CorrectHorseBattery'. No elevated privileges required on the auditor host; the credential needs only basic UI login on the controller.

#!/usr/bin/env bash
# noisgate verifier — CVE-2026-33560 (Daktronics DMP-5000 file service)
# Probes the controller's firmware version banner and compares to the fixed tracks.
# Output: VULNERABLE | PATCHED | UNKNOWN
set -u

TARGET="${1:-}"
USER="${2:-admin}"
PASS="${3:-}"

if [[ -z "$TARGET" || -z "$PASS" ]]; then
  echo "usage: $0 <host-or-ip> <user> <pass>" >&2
  echo "UNKNOWN"; exit 2
fi

# Try the common management endpoints used by DMP-series controllers
for scheme in https http; do
  for port in 443 8082 8080 80; do
    URL="$scheme://$TARGET:$port/api/system/version"
    BODY=$(curl -sk --max-time 5 -u "$USER:$PASS" "$URL" 2>/dev/null) || continue
    VER=$(echo "$BODY" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
    [[ -n "$VER" ]] && break 2
  done
done

if [[ -z "${VER:-}" ]]; then
  echo "could not retrieve firmware version from $TARGET" >&2
  echo "UNKNOWN"; exit 3
fi

MAJ=$(echo "$VER" | cut -d. -f1)
MIN=$(echo "$VER" | cut -d. -f2)

case "$MAJ" in
  8)  FIX_MIN=117 ;;
  9)  FIX_MIN=43  ;;
  10) FIX_MIN=34  ;;
  *)  echo "unrecognized firmware track: $VER" >&2; echo "UNKNOWN"; exit 4 ;;
esac

if (( MIN < FIX_MIN )); then
  echo "running $VER — below fixed minor $MAJ.$FIX_MIN.0.x"
  echo "VULNERABLE"; exit 1
else
  echo "running $VER — at or above fixed minor $MAJ.$FIX_MIN.0.x"
  echo "PATCHED"; exit 0
fi