This vulnerability allows an attacker to bypass normal directory boundaries in Daktronics Controller Firmware, enabling traversal across the file system and enumeration of arbitrary paths. The flaw can be exercised by both authenticated and unauthenticated remote users, potentially exposing sensitive configuration files, logs, or other confidential data. The compromised confidentiality could facilitate further attacks if critical files are read or exploited.

Affected products include Daktronics DMP-5000, Daktronics DMP-8000, and Daktronics VFC-DMP-5000. Firmware versions prior to the recommended updates are at risk; see the vendor’s firmware upgrade guidance for precise version numbers.

The CVSS score of 9.3 indicates a critical level of severity. Although an EPSS score is not available, the lack of entries in the CISA KEV catalog does not diminish the high impact based on the CVSS rating. The vulnerability can be triggered over a network interface that exposes the controller firmware, and because both authenticated and unauthenticated users can exploit it, the attack surface is broad.