Global
Daktronics LED sign controllers have three flaws, including default admin credentials
CISA's advisory ICSA-26-176-04 covers three flaws in Daktronics VFC-DMP-5000, DMP-5000 and DMP-8000 controllers that drive large LED displays, including highway signs and billboards. They are an unauthenticated path traversal (CVE-2026-28701), an authenticated arbitrary file upload (CVE-2026-33560) and default administrator credentials (CVE-2026-31928). Researcher Thomas Jou reported them through CISA's VINCE in January 2026, and Daktronics shipped patched firmware in March 2026, but the researcher said field testing found most internet-exposed units still used the default admin credentials.
- Type
- Vulnerability
- Sector
- Billboard
- Country
- Global
Sources
- ICSA-26-176-04 Daktronics controllers · CISA
- New Controller Flaws Expose Highway Signs and Billboards to Remote Hacking · SecurityWeek
- CVE-2026-28701 · NIST NVD
- New Controller Flaws Expose Highway Signs and Billboards to Remote Hacking · SecurityWeek
- CVE-2026-33560 · cvefeed.io