CVE-2026-5573 is a high severity (CVSS 7.3) unrestricted file upload flaw in Technostrobe HI-LED-WR120-G2 firmware 5.5.0.1R6.03.30. The record names no fixed version and says the vendor did not respond. Take the web interface off untrusted networks and ask the vendor for a patched build.
What's affected
The record lists one product and one firmware build: Technostrobe HI-LED-WR120-G2 running 5.5.0.1R6.03.30. The record places the flaw in the /fs file, through the cwd argument. Technostrobe makes obstruction lighting controllers for towers, turbines and cranes, so these devices tend to sit on remote sites.
The NVD record says the vendor was contacted early about the disclosure and did not respond. No fixed version appears in the record or in the researcher write-up, so do not plan around a patch that may not exist.
How to check if you're exposed
Start with an inventory. Find every Technostrobe controller on your networks and read the firmware version from the device's own status page or from your asset records.
- If you run HI-LED-WR120-G2 on firmware 5.5.0.1R6.03.30, treat the device as affected.
- Check whether its web interface is reachable from the internet or from broad internal networks. Search firewall rules and any external attack surface scan for the device's management address.
- Review web server or proxy logs, where they exist, for requests to the device from addresses you do not expect.
- Compare the device's file listing against a known good copy of its configuration, if you keep one, and note any files you do not recognize.
What to do now
- Take the controller's web management interface off the internet. Reach it only through a VPN or a jump host.
- Put the device on a management network with firewall rules that allow named administrator addresses only.
- Back up the device configuration now, and check for files you did not place on it.
- Contact Technostrobe through your support channel and ask for a fixed firmware build and a security statement. Record the answer.
- Watch the vendor site and the CVE record for a patch, and schedule the upgrade as soon as one appears.
Why it matters
The record lists CWE-434, unrestricted upload of a file with a dangerous type, and CWE-284, improper access control. The upload endpoint accepts files from callers who have not logged in, and the caller can influence where the file ends up. The researcher write-up describes the endpoint as having no authentication.
The score is 7.3 rather than critical because the vector lists only low impact on confidentiality, integrity and availability. That reflects what the scoring model could confirm, not the worst case an embedded device with a writable web root might allow. A public exploit exists, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Upload handlers need three checks: who is calling, what type of file this is, and where it will be written. This one reportedly makes none of them.
Quick check
What is the safest immediate step?
Remove the controller's web interface from the internet and from broad internal networks. Anyone who can reach the interface should be assumed able to reach the upload handler.
Sources
Last reviewed: 19 October 2026.
