CVE Intelligence
Analysis AI-assisted

CVE-2026-5570: Technostrobe HI-LED-WR120-G2 improper authentication in LoginCB

CVE-2026-5570 is an improper authentication weakness (CWE-287) in the index_config function of the LoginCB component of the Technostrobe HI-LED-WR120-G2. The NVD record assigns a CVSS 3.1 base score of 9.8 (critical), and the description states that a public exploit has been disclosed. The record does not list a fixed version and the vendor did not respond to early disclosure, so isolation and compensating controls are the main defensive options.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-5570 concerns the Technostrobe HI-LED-WR120-G2 device, listed in the record at version 5.5.0.1R6.03.30. According to the description, the flaw is in the index_config function reached through the LoginCB file and leads to improper authentication. The record classifies it as CWE-287 (Improper Authentication) and was published by VulDB as CNA on 2026-04-05.

Impact

The NVD record assigns a base score of 9.8 and a critical severity. Its components indicate network reachability, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity and availability. Because the weakness is an authentication failure, the practical consequence is that a remote party may reach functions that should require valid credentials.

Affected products and versions

  • Technostrobe HI-LED-WR120-G2, listed as version 5.5.0.1R6.03.30
  • Technostrobe Hi-led-wr120-g2 Firmware, listed as version 5.5.0.1r6.03.30

The record provides only these single versions and no range boundaries. Whether other firmware builds are affected is unknown from the available data.

Exploitation status

The CISA KEV catalog does not list this CVE, so no confirmed active exploitation is recorded there. The description states that the exploit has been publicly disclosed and may be used, and the record lists an SSVC exploitation value of proof of concept with automatable status yes. The EPSS probability is 0.00993. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • The record does not identify a vendor fix or fixed version, and the vendor did not respond to early disclosure. Treat the absence of a fix as unknown rather than as proof that none exists.
  • Remove direct internet exposure of the device and its login interfaces, and place it behind network controls that restrict access to trusted management hosts.
  • Inventory all deployments of the listed versions, including firmware-only installations, and prioritise those reachable from untrusted networks.
  • Apply any update the vendor publishes when it becomes available, and verify the running firmware afterwards.
  • The record includes a mitigation-type reference in the GitHub repository; its content was not reviewed here, so validate any step it describes against your own testing before applying it.

Detection guidance

  • Review authentication logs for successful logins that come from unexpected or external sources, especially outside maintenance windows.
  • Alert on repeated requests to login-related endpoints from addresses that are not part of the administrative network.
  • Monitor for unexpected configuration changes or new accounts on the device.
  • Correlate device telemetry with perimeter firewall logs to identify traffic reaching the management plane from the internet.

Limitations of the available information

  • No fixed version, vendor advisory or vendor patch is present in the record.
  • Scores differ by provider, ranging from 5.5 to 9.8 in the record, so severity should be assessed in the context of your own exposure.
  • The record lists the product under two naming variants, and the scope of other models or firmware branches is unknown.
  • Exploit details were not analysed here and this content does not describe exploitation steps.

Frequently asked questions

What is CVE-2026-5570?

It is an improper authentication weakness (CWE-287) in the index_config function reached through LoginCB in the Technostrobe HI-LED-WR120-G2, as described in the record.

Is this vulnerability being actively exploited?

The CVE is not listed in the CISA KEV catalog and no confirmed active exploitation appears in the sources consulted. The description states that a public exploit has been disclosed and may be used.

Is there a fixed version?

The record does not identify a fixed version or vendor patch, and the vendor did not respond to early disclosure. This status is unknown rather than confirmed absent.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.