# Daktronics LED sign controllers have three flaws, including default admin credentials

- Date: 2026-06-25
- Location: Global
- Type: Vulnerability
- Sector: Billboard
- CVE: CVE-2026-28701, CVE-2026-31928, CVE-2026-33560

CISA's advisory ICSA-26-176-04 covers three flaws in Daktronics VFC-DMP-5000, DMP-5000 and DMP-8000 controllers that drive large LED displays, including highway signs and billboards. They are an unauthenticated path traversal (CVE-2026-28701), an authenticated arbitrary file upload (CVE-2026-33560) and default administrator credentials (CVE-2026-31928). Researcher Thomas Jou reported them through CISA's VINCE in January 2026, and Daktronics shipped patched firmware in March 2026, but the researcher said field testing found most internet-exposed units still used the default admin credentials.

## Sources

- [ICSA-26-176-04 Daktronics controllers](https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04) (CISA)
- [New Controller Flaws Expose Highway Signs and Billboards to Remote Hacking](https://www.securityweek.com/new-controller-flaws-expose-highway-signs-and-billboards-to-remote-hacking/) (SecurityWeek)
- [CVE-2026-28701](https://nvd.nist.gov/vuln/detail/CVE-2026-28701) (NIST NVD)
- [New Controller Flaws Expose Highway Signs and Billboards to Remote Hacking](https://www.securityweek.com/new-controller-flaws-expose-highway-signs-and-billboards-to-remote-hacking/amp/) (SecurityWeek)
- [CVE-2026-33560](https://cvefeed.io/vuln/detail/CVE-2026-33560) (cvefeed.io)

Page: https://signagelist.org/incidents/2026-06-daktronics-led-sign-controllers-have-three-flaws/