CVE-2026-5574: Technostrobe HI-LED-WR120-G2 FsBrowseClean missing authorization in deletefile
A missing authorization flaw (CWE-862) affects the deletefile function of the FsBrowseClean component in Technostrobe HI-LED-WR120-G2 devices running the listed version. The record states the attack may be initiated remotely and that a public exploit has been disclosed, with an NVD base score of 9.1. No vendor fix was identified in the sources consulted.
Overview
The record describes a missing authorization issue (CWE-862) in the deletefile function of the FsBrowseClean component of the Technostrobe HI-LED-WR120-G2 device. The manipulated argument is dir/path, and the record was published by VulDB and mirrored in NVD.
Impact
- According to the weakness classification, the function does not properly enforce authorization, so a party without the required rights may be able to trigger file deletion.
- The NVD base score is 9.1, which is critical. The NVD vector indicates a network attack vector, low complexity, no privileges required, no user interaction, and high impact on integrity and availability.
- VulDB scores included in the record are lower, between 5.5 and 6.9 depending on the scoring method.
Affected products and versions
- Technostrobe HI-LED-WR120-G2, version 5.5.0.1R6.03.30.
- Technostrobe Hi-led-wr120-g2 Firmware, version 5.5.0.1r6.03.30.
- No fixed version is identified in the record. The two listed strings refer to the same release with different capitalization.
Exploitation status
- The record states that the exploit has been publicly disclosed and may be used.
- The vulnerability is not listed in the CISA KEV catalog according to the record.
- No confirmed exploitation in the wild appears in the sources consulted.
- The SSVC exploitation value is poc (proof of concept), automatable is yes, and technical impact is partial. These are assessments, not confirmed attacks.
- The EPSS probability is 0.00745 with a percentile of 0.54295.
Remediation and mitigation
- No vendor patch is identified in the record, and the vendor reportedly did not respond to early disclosure contact. Check the VulDB entry and the vendor for updates.
- Restrict access to the device management interface to trusted administrative networks only, and avoid exposing it to the internet.
- Review whether affected devices can be isolated or replaced if no vendor update becomes available.
- Verify that file operations on the device are restricted to authorized users where the platform allows it.
Detection guidance
- Review web and management logs for requests to file deletion functions originating from unexpected sources or unknown accounts.
- Monitor for unexpected missing or altered files on the device and compare file listings against known-good baselines.
- Forward device logs to a central monitoring system so that anomalous activity can be investigated.
Limitations of the available information
- No vendor advisory or confirmed fixed version is present in the record.
- The record relies on VulDB and NVD data; scores differ between providers.
- Technical details of the public exploit were not verified, and this analysis does not describe them.
- Whether the issue is reachable depends on each deployment's network configuration, which the record does not describe.
Frequently asked questions
Is this vulnerability being actively exploited?
The record states a public exploit has been disclosed, but the vulnerability is not listed in CISA KEV and no confirmed exploitation in the wild appears in the sources consulted.
Is there a vendor fix?
No vendor fix is identified in the record. The only fix-related reference is a mitigation note, so check the vendor and the VulDB entry for updates.
What should administrators do now?
Restrict access to the device management interface to trusted networks, monitor for unexpected file removals, and plan isolation or replacement if no update is released.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.