CVE-2026-5574: Missing Authorization in Technostrobe Controller

CVE-2026-5574 is a medium severity (CVSS 6.5) missing authorization flaw in the file management feature of Technostrobe HI-LED-WR120-G2 firmware 5.5.0.1R6.03.30. The record names no fix and says the vendor did not respond. Isolate the device and ask Technostrobe for a patched build.

What's affected

The record lists one product and one firmware build: Technostrobe HI-LED-WR120-G2 running 5.5.0.1R6.03.30. The record places the flaw in the deletefile function of the FsBrowseClean component, through the dir and path arguments. Technostrobe makes obstruction lighting controllers for towers, turbines and cranes, so these devices tend to sit on remote sites.

The NVD record says the vendor was contacted early about the disclosure and did not respond. No fixed version appears in the record or in the researcher write-up, so do not plan around a patch that may not exist.

How to check if you're exposed

Start with an inventory. Find every Technostrobe controller on your networks and read the firmware version from the device's own status page or from your asset records.

• If you run HI-LED-WR120-G2 on firmware 5.5.0.1R6.03.30, treat the device as affected.
• Check whether its web interface is reachable from the internet or from broad internal networks. Search firewall rules and any external attack surface scan for the device's management address.
• Review web server or proxy logs, where they exist, for requests to the device from addresses you do not expect.
• Keep a copy of the device's file layout so you can tell if something is missing.

What to do now

1. Take the controller's web management interface off the internet. Reach it only through a VPN or a jump host.
2. Put the device on a management network with firewall rules that allow named administrator addresses only.
3. Export the device configuration and keep an offline copy, so you can restore it if files disappear.
4. Contact Technostrobe through your support channel and ask for a fixed firmware build and a security statement. Record the answer.
5. Watch the vendor site and the CVE record for a patch, and schedule the upgrade as soon as one appears.

Why it matters

The record lists CWE-862, missing authorization, and CWE-863, incorrect authorization. The file management handler removes files without asking whether the caller is allowed to. The vector is AV:N/AC:L/PR:N/UI:N, with no confidentiality impact but low integrity and availability impact.

The score is lower than the sibling issues in the same firmware because it reveals no data. The effect is still real. The researcher write-up describes deleting files the web server needs, which could break login or other device functions. A public exploit exists, and the CVE is not listed as exploited in CISA's catalog.

The pattern is the same across the Technostrobe set: a small embedded web server that trusts every caller. If you run these devices, the fix is a network design change, because the product gives you nothing else to work with today.

Quick check

Sources

• Researcher write-up for CVE-2026-5574

Last reviewed: 19 October 2026.