by Kastro
Paper/Archive/CVE-2026-31928

CVE-2026-31928

Daktronics VFC-DMP-5000 — Daktronics Controller Firmware Use of Hard-coded Credentials

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 47.1.471 × 209.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed during initial configuration or operation. Using these accounts provides full system access.

Affected

ProductAffectedFixed inSource
VFC-DMP-5000< v8.117.x.xv8.117.x.xCNA
VFC-DMP-5000< v9.43.x.xv9.43.x.xCNA
VFC-DMP-5000< v10.34.x.xv10.34.x.xCNA
DMP-5000< v10.34.x.xv10.34.x.xCNA
DMP-5000< v8.117.x.xv8.117.x.xCNA
DMP-5000< v9.43.x.xv9.43.x.xCNA
DMP-8000< v10.34.x.xv10.34.x.xCNA
DMP-8000< v8.117.x.xv8.117.x.xCNA
DMP-8000< v9.43.x.xv9.43.x.xCNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
icscert (CNA)8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-26-176-04refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-04.json