CVE-2026-33560CWE-434

Daktronics Controller Firmware Unrestricted Upload of File with Dangerous Type

High · published June 26, 2026

CVSS v4.0
8.4
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and scripts to be accepted and written directly to the server.

The record
Technical detail
CVSS v4.0
8.4 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N
EPSS
0.00444 · 37.6th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-06-26T22:48Z
EPSS history
Timeline
  • 26 JUN 22:48Z
    Daktronics Controller Firmware Unrestricted Upload of File with Dangerous Type
    cvelistv5