CVE-2026-31928

EUVD-2026-39925
The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed during initial configuration or operation. Using these accounts provides full system access.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 34.22%
Affected Products (NVD)
VendorProductVersion
daktronicsdmp-5000_firmware
𝑥
< 8.117.0.0
daktronicsdmp-5000_firmware
9.0.0.0 ≤
𝑥
< 9.43.0.0
daktronicsdmp-5000_firmware
10.0.0.0 ≤
𝑥
< 10.34.0.0
daktronicsdmp-8000_firmware
𝑥
< 8.117.0.0
daktronicsdmp-8000_firmware
9.0.0.0 ≤
𝑥
< 9.43.0.0
daktronicsdmp-8000_firmware
10.0.0.0 ≤
𝑥
< 10.34.0.0
daktronicsvfc-dmp-5000_firmware
𝑥
< 8.117.0.0
daktronicsvfc-dmp-5000_firmware
9.0.0.0 ≤
𝑥
< 9.43.0.0
daktronicsvfc-dmp-5000_firmware
10.0.0.0 ≤
𝑥
< 10.34.0.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-04.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04