CVE-2026-28701: Daktronics Controller Firmware Path Traversal

Synopsis

A path traversal vulnerability in Daktronics Controller Firmware (VFC-DMP-5000, DMP-5000, and DMP-8000) allows remote users, both authenticated and unauthenticated, to escape the intended directory and read arbitrary file system paths over the network. No credentials are required, and no victim interaction is needed, making this trivially reachable from any network-connected host. Successful exploitation exposes sensitive files on the controller, enables modification of arbitrary file system content, and can disrupt controller availability. Patched-image rebuilds at versions v10.34.x.x, v8.117.x.x, and v9.43.x.x are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the controller's firmware interface over the network; no local or physical access is required.

• AuthenticationNot required

  The vulnerability is exploitable without any credentials; unauthenticated remote users can trigger the path traversal directly.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker sends a crafted request directly to the device.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout knowledge, or special environmental factors are required.

Blast Radius

• An attacker can read arbitrary files on the controller file system, including configuration files, credentials, and operational data.
• An attacker can modify arbitrary file system content, enabling tampering with controller configuration or firmware components.
• The controller's availability can be disrupted, potentially affecting connected display or signage infrastructure managed by the device.