EUVD-2026-19089
GHSA-xr7q-4cmw-j44v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was determined in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. The affected element is the function index_config of the file /LoginCB. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Improper authentication in Technostrobe HI-LED-WR120-G2 version 5.5.0.1R6.03.30 allows unauthenticated remote attackers to bypass authentication controls via the index_config function in /LoginCB endpoint. Publicly available exploit code exists. With EPSS data unavailable and no CISA KEV listing, exploitation likelihood remains moderate, though the low attack complexity (CVSS AC:L) and network-accessible attack vector increase accessibility for opportunistic attacks against exposed industrial LED display controllers.
Technical ContextAI
This vulnerability affects Technostrobe HI-LED-WR120-G2 industrial LED display controllers running firmware version 5.5.0.1R6.03.30. The flaw resides in the index_config function within the /LoginCB file, which handles authentication callbacks during the login process. The root cause is CWE-287 (Improper Authentication), indicating the authentication mechanism fails to properly verify user credentials or session state. Industrial LED controllers like the HI-LED-WR120-G2 typically provide web-based management interfaces for configuring display content, scheduling, and network settings. The /LoginCB endpoint appears to be a critical authentication control point where the improper implementation allows attackers to circumvent credential verification entirely. Given the network-accessible nature (CVSS AV:N) and lack of required user interaction (UI:N), this suggests a direct HTTP/HTTPS interface vulnerability exploitable through crafted requests to the vulnerable endpoint.
RemediationAI
No vendor-released patch identified at time of analysis. The vendor (Technostrobe) was contacted during coordinated disclosure but provided no response and has not issued security advisories or firmware updates per available references (https://vuldb.com/submit/783323). Organizations operating HI-LED-WR120-G2 controllers should implement immediate compensating controls: isolate affected devices from internet access by placing them behind firewalls with strict IP whitelisting, restrict management interface access to trusted internal networks only via VLANs or network segmentation, implement reverse proxy authentication if remote management is required, and monitor authentication logs at /LoginCB endpoint for suspicious activity patterns. Consider replacing affected units with alternative vendors if Technostrobe continues non-responsiveness to security issues. Consult VulDB threat intelligence feed (https://vuldb.com/vuln/355340/cti) for emerging exploitation indicators. Establish vendor communication channels to request security patches or end-of-life guidance for this product line.
More in Hi Led Wr120 G2
View allUnrestricted file upload in Technostrobe HI-LED-WR120-G2 firmware version 5.5.0.1R6.03.30 allows remote unauthenticated
Improper access controls in Technostrobe HI-LED-WR120-G2 firmware 5.5.0.1R6.03.30 enable unauthenticated remote attacker
Technostrobe HI-LED-WR120-G2 firmware versions up to 5.5.0.1R6.03.30 allow remote unauthenticated attackers to disclose
Remote unauthenticated attackers can bypass authorization checks in the FsBrowseClean component's deletefile function of
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today