Thomas Jou

**Name of the Vulnerable Software and Affected Versions** Daktronics Controller Firmware (affected versions not specified) **Description** Remote authenticated and unauthenticated users can perform path traversal, which allows them to escape the intended directory and enumerate arbitrary file system paths over the network without user interaction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DMP-5000 (affected versions not specified) **Description** Devices are shipped with a default administrative web account that utilizes weak authentication controls. These credentials are not required to be changed during the initial configuration or operation of the system, allowing an attacker to gain full system access. **Recommendations** Change the default administrative credentials immediately.

**Name of the Vulnerable Software and Affected Versions** DMP-5000 (affected versions not specified) **Description** The file service allows authenticated users to upload files of any type without validation. The system does not enforce file extension filtering or content inspection, which enables the upload of executable binaries and scripts directly to the server. **Recommendations** Restrict file upload permissions immediately.