CISA published an advisory detailing three vulnerabilities in Daktronics controllers (VFC-DMP-5000, DMP-5000, DMP-8000) that manage large-scale LED displays. The flaws include an unauthenticated path traversal allowing arbitrary file system enumeration, an authenticated arbitrary file upload vulnerability, and the presence of default administrator credentials that many internet-exposed devices still use. Successful exploitation could grant unauthenticated attackers root-level control, enabling manipulation of highway signs and billboards to display false or malicious messages. The vulnerabilities were reported via CISA's VINCE platform in early 2026, with Daktronics releasing patches by March 2026 and advising password changes. The researcher noted that internet exposure of these controllers is due to customer configuration, not vendor deployment. The vulnerabilities pose risks from information disclosure to full device compromise.

The vulnerabilities allow attackers to perform reconnaissance by reading arbitrary files, discover credentials, upload malicious content or code, and potentially gain full root access to the affected controllers. This could lead to unauthorized alteration of highway signs and billboards, displaying false or malicious messages, which may cause public safety risks or misinformation. The presence of default credentials on many internet-exposed devices increases the likelihood of exploitation. However, exploitation requires the devices to be exposed to the internet, which is a customer responsibility. No known exploits in the wild have been reported.

Daktronics has released firmware patches addressing these vulnerabilities. Users should apply these patches promptly. Additionally, changing default administrator passwords is critical, as many devices still use default credentials. Customers should ensure that controllers are not exposed directly to the internet to reduce remote exploitation risk. Since the vendor has provided official patches and guidance, applying these updates and following recommended password policies effectively mitigates the vulnerabilities.