Daktronics firmware exposes authenticated endpoints that allow users to upload files of any type without validation or content inspection. This flaw means an attacker with credentials can upload executable binaries or scripts, which the device writes directly to its filesystem, potentially enabling execution of malicious code and full compromise of the controller.

The vulnerability affects Daktronics DMP-5000, DMP-8000, and VFC-DMP-5000 devices. The vendor recommends updating to firmware 8.117.0.x, 9.43.0.x, or 10.34.0.x depending on product configuration to remediate the issue.

With a CVSS score of 8. data is available, the lack of a KEV listing does not diminish the risk—an attacker who authenticates can upload malicious files any time the service is reachable. The primary attack vector requires valid credentials, making the vulnerability less exploitable than unauthenticated flaws but still critical due to the ability to execute arbitrary code once authenticated.