Arbitrary file upload in Daktronics Dmp-5000
CVE-2026-33560
The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and scripts to be accepted and written directly to the server.
Vulnerability class: Unrestricted File Upload
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N.
EPSS exploit prediction
EPSS: 0.004 (36.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 36th percentile — 36.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Daktronics Dmp-5000 — versions 0
- Daktronics Dmp-5000 Firmware
- Daktronics Dmp-8000 — versions 0
- Daktronics Dmp-8000 Firmware
- Daktronics Vfc-Dmp-5000 — versions 0
- Daktronics Vfc-Dmp-5000 Firmware
Weakness classification (CWE)
References
- github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-04.js… (Third Party Advisory)
- www.cisa.gov/news-events/ics-advisories/icsa-26-176-04 (US Government Resource, Third Party Advisory)
Frequently asked questions
- What is CVE-2026-33560?
- CVE-2026-33560 is a high-severity vulnerability in Daktronics Dmp-5000, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 7.1/10. Published 2026-06-26.
- How severe is CVE-2026-33560?
- High severity. CVSS v3 base score is 7.1 out of 10.