CVE-2026-5569 is a high severity (CVSS 7.3) broken access control flaw in the web interface of the Technostrobe HI-LED-WR120-G2 tower light controller, firmware 5.5.0.1R6.03.30. The record names no fix and says the vendor did not respond, so the practical answer is to isolate the device.
What's affected
The record lists one product and one firmware build: Technostrobe HI-LED-WR120-G2 running 5.5.0.1R6.03.30. The weakness sits in the /Technostrobe/ path of the device's endpoint component, and the record says multiple endpoints are affected. Technostrobe makes obstruction lighting controllers for towers, turbines and cranes, so these devices tend to sit on remote sites.
The NVD record says the vendor was contacted early about the disclosure and did not respond. No fixed version appears in the record or in the researcher write-up, so do not plan around a patch that may not exist.
How to check if you're exposed
Start with an inventory. Find every Technostrobe controller on your networks and read the firmware version from the device's own status page or from your asset records.
- If you run HI-LED-WR120-G2 on firmware 5.5.0.1R6.03.30, treat the device as affected.
- Check whether its web interface is reachable from the internet or from broad internal networks. Search firewall rules and any external attack surface scan for the device's management address.
- Review web server or proxy logs, where they exist, for requests to the device from addresses you do not expect.
What to do now
- Take the controller's web management interface off the internet. Reach it only through a VPN or a jump host.
- Put the device on a management network with firewall rules that allow named administrator addresses only.
- Treat anything the controller's web interface exposes as readable and changeable by an outsider until proven otherwise, and record its current configuration so you can spot unexpected changes.
- Contact Technostrobe through your support channel and ask for a fixed firmware build and a security statement. Record the answer.
- Watch the vendor site and the CVE record for a patch, and schedule the upgrade as soon as one appears.
Why it matters
The CVSS vector is AV:N/AC:L/PR:N/UI:N with low impact on confidentiality, integrity and availability. In plain terms, it can be reached over the network without an account and without tricking anyone.
The record lists CWE-284, improper access control, and CWE-266, incorrect privilege assignment. Both describe an interface that does not decide properly who is allowed to do what. Embedded devices often ship this way: a small web server added for convenience, with no real access model behind it. The record says a public exploit exists. It is not listed in CISA's Known Exploited Vulnerabilities catalog.
Because these controllers support aviation safety lighting, the sensible response is network isolation first and vendor pressure second.
Quick check
Is there a patch?
The record and the researcher write-up name no fixed version, and the record says the vendor did not respond. Ask the vendor directly and isolate the device in the meantime.
Sources
Last reviewed: 19 October 2026.
