8.8
CVE-2026-33560
- EPSS 0.33%
- Veröffentlicht 26.06.2026 22:48:56
- Zuletzt bearbeitet 06.07.2026 17:53:59
- CVE-Watchlists
- Unerledigt
LoginDaktronics Controller Firmware Unrestricted Upload of File with Dangerous Type
The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and scripts to be accepted and written directly to the server.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Daktronics ≫ Dmp-5000 Firmware Version < 8.117.0.0
Daktronics ≫ Dmp-5000 Firmware Version >= 9.0.0.0 < 9.43.0.0
Daktronics ≫ Dmp-5000 Firmware Version >= 10.0.0.0 < 10.34.0.0
Daktronics ≫ Dmp-8000 Firmware Version < 8.117.0.0
Daktronics ≫ Dmp-8000 Firmware Version >= 9.0.0.0 < 9.43.0.0
Daktronics ≫ Dmp-8000 Firmware Version >= 10.0.0.0 < 10.34.0.0
Daktronics ≫ Vfc-dmp-5000 Firmware Version < 8.117.0.0
Daktronics ≫ Vfc-dmp-5000 Firmware Version >= 9.0.0.0 < 9.43.0.0
Daktronics ≫ Vfc-dmp-5000 Firmware Version >= 10.0.0.0 < 10.34.0.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.33% | 0.255 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| DHS.gov | 8.4 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| DHS.gov | 7.1 | 2.8 | 4.2 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
|
CWE-434 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-04.json