CVE-2026-31928: Daktronics DMP-5000 Default Administrative Account Vulnerability

Overview

CVE-2026-31928 is classified by the record as CWE-798 (Use of Hard-coded Credentials). The CNA describes Daktronics DMP-5000 devices as shipped with a default administrative web account whose authentication controls are weak, and which is not required to be changed during initial configuration or operation.

Impact

• According to the description, use of these default accounts provides full system access.
• NVD scores the vulnerability 9.8 under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CNA ICS-CERT lists 8.1 under CVSS 3.1 and 9.3 under CVSS 4.0.
• Based on the vector, the flaw is reachable over the network without privileges or user interaction (inference from the vector metrics), and it affects confidentiality, integrity and availability.

Affected products and versions

The record lists the following products and ranges as affected:

• Daktronics Dmp-5000 Firmware: versions less than 8.117.0.0, 9.0.0.0 up to but not including 9.43.0.0, and 10.0.0.0 up to but not including 10.34.0.0.
• Daktronics Dmp-8000 Firmware: same ranges as above.
• Daktronics Vfc-dmp-5000 Firmware: same ranges as above.

The record does not list any fixed versions. The absence of fixed versions in the record does not mean no fix exists; consult the CISA advisory for remediation details.

Exploitation status

The CISA Known Exploited Vulnerabilities catalog does not list this CVE in the record, so active exploitation is not confirmed by that source. No confirmed exploitation appears in the sources consulted. The EPSS estimate in the record (probability 0.00569, percentile 0.45618) is a statistical prediction and not evidence of exploitation.

Remediation and mitigation

• Inventory all DMP-5000, DMP-8000 and VFC-DMP-5000 devices and their firmware versions against the ranges above.
• Review the CISA advisory ICSA-26-176-04 for vendor guidance on updated firmware and any credential-related steps.
• Where vendor guidance allows, replace default administrative credentials and limit who can reach the device web interface.
• Restrict network exposure of the devices by placing them behind segmented networks and firewalls, and avoid exposing management interfaces to untrusted networks.

Detection guidance

• Monitor authentication logs of the device web interface for successful administrative logins from unexpected sources or at unusual times.
• Alert on administrative sessions originating outside approved management networks.
• Track configuration changes and firmware changes on these devices as part of routine asset monitoring.

Limitations of the available information

• The record does not state the specific default account names or whether a supported procedure exists to change them.
• The record does not provide the fixed firmware versions for each product line.
• The record does not describe any observed attacks or proof-of-concept activity.
• The CNA scores differ across CVSS versions and providers, and the record does not explain the differences.

Frequently asked questions

What is CVE-2026-31928?

It is a weakness in Daktronics DMP-5000 devices, classified as use of hard-coded credentials, where a default administrative web account has weak authentication and is not required to be changed. According to the record, use of these accounts provides full system access.

Is this vulnerability being actively exploited?

The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog in the record, and no confirmed exploitation appears in the sources consulted.

Which products are affected?

The record lists Daktronics Dmp-5000, Dmp-8000 and Vfc-dmp-5000 firmware within the version ranges shown in the affected products section of the analysis.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.