CVE-2026-33560: Daktronics Controller Firmware Unrestricted Upload of File with Dangerous Type
The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and scripts to be accepted and written directly to the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Daktronics Controller Firmwareto a version that resolves this vulnerability.Fixed in 8.117.0.x - Upgrade
Upgrade
Daktronics Controller Firmwareto a version that resolves this vulnerability.Fixed in 9.43.0.x - Upgrade
Upgrade
Daktronics Controller Firmwareto a version that resolves this vulnerability.Fixed in 10.34.0.x
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33560?
The severity of CVE-2026-33560 is rated high with a score of 8.4.
How do I fix CVE-2026-33560?
To remediate CVE-2026-33560, ensure that strict validation and filtering are enforced for file uploads on the Daktronics Controller Firmware.
What type of vulnerability is CVE-2026-33560?
CVE-2026-33560 is classified as a Malicious File Upload vulnerability.
What risks are associated with CVE-2026-33560?
CVE-2026-33560 poses a risk of unauthorized file execution due to arbitrary file uploads without validation.
Which software is affected by CVE-2026-33560?
CVE-2026-33560 affects the Daktronics Controller Firmware.