CVE-2026-5570 is a high severity (CVSS 7.3) improper authentication flaw in Technostrobe HI-LED-WR120-G2 firmware 5.5.0.1R6.03.30. It affects the login callback in the device's web interface. The record lists no fix and says the vendor did not respond, so isolate the device and ask Technostrobe for a patch.
What's affected
The record lists one product and one firmware build: Technostrobe HI-LED-WR120-G2 running 5.5.0.1R6.03.30. The record places the flaw in the index_config function of the /LoginCB file, which handles login. Technostrobe makes obstruction lighting controllers for towers, turbines and cranes, so these devices tend to sit on remote sites.
The NVD record says the vendor was contacted early about the disclosure and did not respond. No fixed version appears in the record or in the researcher write-up, so do not plan around a patch that may not exist.
How to check if you're exposed
Start with an inventory. Find every Technostrobe controller on your networks and read the firmware version from the device's own status page or from your asset records.
- If you run HI-LED-WR120-G2 on firmware 5.5.0.1R6.03.30, treat the device as affected.
- Check whether its web interface is reachable from the internet or from broad internal networks. Search firewall rules and any external attack surface scan for the device's management address.
- Review web server or proxy logs, where they exist, for requests to the device from addresses you do not expect.
- The researcher write-up says the embedded web server listens on port 58746. Look for that port on your scans.
What to do now
- Take the controller's web management interface off the internet. Reach it only through a VPN or a jump host.
- Put the device on a management network with firewall rules that allow named administrator addresses only.
- Do not rely on the device's login screen as a control. Assume that anyone who can reach the interface might get past it.
- Contact Technostrobe through your support channel and ask for a fixed firmware build and a security statement. Record the answer.
- Watch the vendor site and the CVE record for a patch, and schedule the upgrade as soon as one appears.
Why it matters
The weakness is CWE-287, improper authentication. The researcher write-up describes a login decision that depends on what the browser is told rather than on a check the server enforces. When the client side holds the decision, anyone who controls the client can change it.
The vector is AV:N/AC:L/PR:N/UI:N, so it needs no account and no user action. The record says an exploit is public. The CVE is not in CISA's Known Exploited Vulnerabilities catalog.
The fix for this class of bug is to enforce authentication on the server for every request, not only at the login page. Until the vendor ships that, network controls are the only defense you have.
Quick check
Does a strong password help?
Not against this class of flaw. The problem is how the login result is checked, not how guessable the password is, so network isolation is the control that matters.
Sources
Last reviewed: 19 October 2026.
