CVE-2026-28701

MediumCVSS 5.3/10Last modified Jul 6, 2026

Description

Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate arbitrary file system paths.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Daktronics	VFC-DMP-5000	< v8.117.x.x; < v9.43.x.x; < v10.34.x.x
Daktronics	DMP-5000	< v10.34.x.x; < v8.117.x.x; < v9.43.x.x
Daktronics	DMP-8000	< v10.34.x.x; < v8.117.x.x; < v9.43.x.x

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-04.jsonThird Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04Third Party Advisory, US Government Resource

Timeline

Published: Jun 26, 2026
Last modified: Jul 6, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-287026.3Incorrect default permissions for the Intel(R) VTune(TM) Profiler software within Ring 3: User Applications may allow an escalation of privi CVE-2026-287034.8Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report.CVE-2026-287048.4Emocheck insecurely loads Dynamic Link Libraries (DLLs). If a crafted DLL file is placed to the same directory, an arbitrary code may be exe CVE-2026-287055.3Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing speci CVE-2026-287075.4Protection mechanism failure for some LLM-on-Ray before version 1.0 within Ring 3: User Applications may allow an escalation of privilege. U CVE-2026-287094.3Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linu CVE-2026-28718.8A weakness has been identified in Tenda A21 1.0.0.0. This affects the function fromSetIpMacBind of the file /goform/SetIpMacBind. This manip CVE-2026-287109.8Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect CVE-2026-287116.3Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) befor CVE-2026-287126.3Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) befor CVE-2026-287137.1Default credentials set for local privileged user in Virtual Appliance. The following products are affected: Acronis Cyber Protect Cloud Age CVE-2026-287144.8Unnecessary transmission of sensitive cryptographic material. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows)