Loading story…
CISA issued an advisory for multiple vulnerabilities in Daktronics VFC-DMP-5000, DMP-5000, and DMP-8000 controllers used to operate highway message boards, roadside signs, digital billboards, and other large LED displays. Reported by researcher Thomas Jou, the flaws include path traversal or path enumeration, unrestricted or arbitrary file upload, and the use of default administrator credentials, which together can allow unauthorized remote access and potentially root-level control of exposed devices.
The researcher found that multiple controllers were reachable from the internet and that many still used default credentials, making remote exploitation and manipulation of displayed content feasible. Daktronics released patched firmware following coordinated disclosure through CISA's VINCE platform, while CISA and reporting on the advisory urged operators to apply updates, change default passwords, and remove direct internet exposure to reduce the risk of compromise.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Researcher Thomas Jou discovered vulnerabilities in internet-exposed Daktronics display controllers and reported them through CISA's VINCE platform in January 2026.
CISA published an advisory describing vulnerabilities in Daktronics display controllers used for highway signs, billboards, and other LED displays, warning that the issues could enable remote compromise and manipulation of devices. The advisory also highlighted mitigations such as changing default credentials and reducing direct internet exposure.
By early March, Daktronics had prepared patched firmware for the affected VFC-DMP-5000, DMP-5000, and DMP-8000 display controllers following coordinated disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcesecurityweek.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA released an advisory detailing two out-of-bounds write vulnerabilities in Delta Electronics DIAScreen, a product used in industrial control systems. The affected product versions include DIAScreen version 1.6.0 and prior. These vulnerabilities, identified as CVE-2025-59297 and CVE-2025-59298, can be exploited when a valid user opens a maliciously crafted project file, allowing an attacker to write data outside the allocated memory buffer. Both vulnerabilities are rated with a CVSS v3.1 base score of 6.6 and a CVSS v4 base score of 6.8, indicating a medium severity level. The attack complexity is considered low, and exploitation does not require privileges, but user interaction is necessary. Successful exploitation could result in loss of confidentiality, integrity, and availability, with a particular risk of denial-of-service or potential code execution. CISA's advisory provides technical details about the vulnerabilities and recommends mitigations to reduce risk. Administrators and users are encouraged to review the advisory and apply the recommended security measures. The vulnerabilities highlight the ongoing risks associated with file parsing in industrial control system software. Delta Electronics is a major vendor in the ICS sector, and vulnerabilities in its products can have significant operational impacts. The advisories were released on October 7, 2025, as part of CISA's ongoing efforts to inform the ICS community about emerging threats. The technical details specify that the vulnerabilities are triggered by opening malicious project files, emphasizing the importance of user awareness and safe file handling practices. The advisory does not mention active exploitation in the wild at the time of publication. CISA's notification is part of a broader set of ICS advisories released on the same date, but the DIAScreen vulnerabilities are specifically addressed in their own advisory. The disclosure underscores the need for timely patching and adherence to vendor guidance in industrial environments. Organizations using DIAScreen should assess their exposure and implement mitigations as soon as possible. The vulnerabilities are tracked under the Common Weakness Enumeration (CWE) identifier CWE-787, which relates to out-of-bounds write issues. The advisory also provides links to further technical resources and encourages feedback from the ICS community.
Jun 29, 2026
CISA published ICS advisories warning of **critical “missing authentication for critical function”** weaknesses (CWE-306) that expose device management/control interfaces to unauthenticated access. **Synectix LAN 232 TRIO** (3-port serial-to-Ethernet adapter) is affected in **all versions** under **CVE-2026-1633** with **CVSS 3.1 10.0**, enabling unauthenticated attackers to **modify critical device settings** or **factory reset** the device. **Avation Light Engine Pro** is also affected in **all versions** under **CVE-2026-1341** with **CVSS 3.1 9.8**, allowing an attacker to **take full control** of the device due to an exposed configuration/control interface without authentication. Separate reporting highlighted a similar CISA alert for **KiloView Encoder Series** devices, tracked as **CVE-2026-1453** with **CVSS 9.8**, where missing authentication allows unauthenticated users to perform administrative actions such as **creating or deleting administrator accounts**, potentially granting full administrative control and enabling disruption or hijacking of broadcast/streaming workflows. The KiloView issue was described as affecting multiple Encoder Series models and specific firmware/hardware combinations (e.g., E1/E1-s/E2 with listed firmware versions), reinforcing the broader risk of internet- or enterprise-exposed device management planes lacking access control.
Jun 29, 2026
CERT/CC disclosed three critical zero-day vulnerabilities in ViewSonic vCast software for Android-based ViewBoard interactive displays: `CVE-2026-82987`, `CVE-2026-82988`, and `CVE-2026-82989`. An attacker on the same network can exploit exposed unauthenticated services to capture the display screen, inject input commands, and remotely install an attacker-controlled Android APK without user interaction. Chaining the flaws can enable surveillance of displayed content, arbitrary code execution, persistence, and effective full control of affected boards. A compromised ViewBoard could also serve as a foothold for lateral movement into connected education or enterprise networks. CERT/CC said it had been unable to reach ViewSonic and no fixes had been provided at disclosure; organizations should isolate affected displays, tightly restrict network access, and monitor them until patches are available.
Sep 28, 2026