New Controller Flaws Expose Highway Signs and Billboards to Remote Hacking
Source SecurityWeek
Rated Medium by Threat Radar from the SecurityWeek text
Data as of 30 Jun 2026, 05:06 UTC
What to do
AI-suggested
Daktronics has released firmware patches addressing these vulnerabilities. Users should apply these patches promptly. Additionally, changing default administrator passwords is critical, as many devices still use default credentials. Customers should ensure that controllers are not exposed directly to the internet to reduce remote exploitation risk. Since the vendor has provided official patches and guidance, applying these updates and following recommended password policies effectively mitigates the vulnerabilities.
Description
Three vulnerabilities were discovered in Daktronics VFC-DMP-5000, DMP-5000, and DMP-8000 controllers used for large-scale LED displays such as highway signs and billboards. These include a path traversal vulnerability exploitable without authentication, an authenticated arbitrary file upload flaw, and default admin credentials that often remain unchanged. Exploiting these could allow attackers to gain root-level access, tamper with displayed content, or fully compromise the device. Patches have been released by Daktronics, and users are advised to change default passwords. The vulnerabilities were responsibly disclosed through CISA's VINCE platform. The impact ranges from reconnaissance to full device control, but exploitation requires internet exposure of the devices, which is the responsibility of the customers to manage.