The Daktronics VFC-DMP-5000 file service exposes endpoints that permit authenticated users to upload arbitrary files without any validation or filtering. This lack of file extension and content inspection allows potentially malicious executable binaries and scripts to be uploaded and stored on the server, which could lead to unauthorized code execution or compromise of the system. The vulnerability is identified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The CVSS v3.1 base score is 7.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. No patch or official remediation is currently documented, and no known exploits are reported in the wild.

The vulnerability allows authenticated users to upload arbitrary files, including executable binaries and scripts, without restriction. This can lead to high integrity impact by enabling attackers to execute unauthorized code or modify system behavior. Confidentiality impact is low, and availability is not affected. Exploitation requires valid authentication but no user interaction. The lack of file validation increases the risk of system compromise or persistent malicious code deployment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to only trusted users and monitor file uploads closely. Consider implementing external controls such as network segmentation or file integrity monitoring to detect unauthorized uploads. Avoid exposing the file upload service to untrusted users. Follow vendor advisories for updates on patches or official mitigations.