CVE-2026-31928 is a default administrative web account on Daktronics DMP-5000, DMP-8000 and VFC-DMP-5000 controllers, scored 8.1. The account is not forced to change and gives full system access. Daktronics advises updating firmware and replacing default passwords.
What's affected
Per the CISA advisory ICSA-26-176-04, the devices are Daktronics DMP-5000, DMP-8000 and VFC-DMP-5000 controllers on firmware older than 8.117.x.x, 9.43.x.x or 10.34.x.x, depending on the product line and configuration.
Daktronics recommends updating to one of 8.117.0.x, 9.43.0.x or 10.34.0.x, whichever matches the configuration in use.
The same advisory covers other weaknesses in these controllers, including directory traversal and an authenticated file upload issue. This post covers the default account, CVE-2026-31928.
How to check if you're exposed
Identify controllers by model and read the firmware version from the device's administration interface or your asset records. Compare it with the three fixed branches above.
Then check the network side, which matters more than usual for this class of device. CISA advises minimizing network exposure so control system devices are not reachable from the internet, and keeping them behind firewalls and away from business networks. Search your external attack surface for the controllers' web interface, and check whether the default administrative login still works on units you manage. Do that only on devices you own.
What to do now
- Update affected controllers to 8.117.0.x, 9.43.0.x or 10.34.0.x, matching your product configuration.
- Change the default administrative password on every unit to a strong, unique value.
- Take the devices off the internet. Place them behind a firewall and reach them over a VPN when remote access is needed.
- Separate these controllers from business networks.
- Use CISA's recommended practices and report suspected malicious activity through your normal channel.
Why it matters
The weakness class is CWE-798, use of hard-coded credentials. A default account that ships on every unit and need not be changed removes the need for any exploit, since the attacker only has to know or guess the login.
Display and signage controllers sit in an odd spot. They are small embedded systems, often installed by contractors and then forgotten, but they run on real networks. CISA's summary says successful exploitation of the advisory's vulnerabilities could give an unauthenticated user complete root level access.
CISA also states that no known public exploitation specifically targeting these vulnerabilities had been reported to it at the time of the advisory. The record does not list this CVE in the KEV catalog. That makes this a cleanup and exposure task, but a worthwhile one.
Quick check
Is changing the password enough?
It closes the default account problem, but the advisory also recommends firmware updates because of other weaknesses in the same controllers.
Where do I find the fixed firmware?
Follow Daktronics' guidance through the CISA advisory. Check it directly for current download steps.
Sources
Last reviewed: 19 October 2026.
