Is there a public PoC exploit available for CVE-2026-5574?

Yes, a public proof-of-concept exploit is available for CVE-2026-5574. Prioritise patching immediately. EPSS: 0.0%.

Hi Led Wr120 G2 CVE-2026-5574

Q: What is the CVSS score of CVE-2026-5574?

CVE-2026-5574 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19097 MEDIUM

Missing Authorization (CWE-862)

2026-04-05 VulDB

GHSA-c8wj-h7ff-q6mj

Authentication Bypass Hi Led Wr120 G2 Technostrobe

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 15:00 euvd

EUVD-2026-19097

Analysis Generated

Apr 05, 2026 - 15:00 vuln.today

CVE Published

Apr 05, 2026 - 14:45 nvd

MEDIUM 6.9

DescriptionCVE.org

A security vulnerability has been detected in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. Affected is the function deletefile of the component FsBrowseClean. The manipulation of the argument dir/path leads to missing authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Remote unauthenticated attackers can bypass authorization checks in the FsBrowseClean component's deletefile function of Technostrobe HI-LED-WR120-G2 version 5.5.0.1R6.03.30 by manipulating the dir/path argument, enabling unauthorized file deletion. Publicly available exploit code exists, and the vendor has not responded to early disclosure notifications. CVSS 6.9 reflects moderate integrity impact with network-accessible attack surface and low attack complexity.

Technical ContextAI

The vulnerability resides in the FsBrowseClean component, a file system browsing and cleanup utility within the Technostrobe HI-LED-WR120-G2 LED display controller firmware. The deletefile function fails to properly validate authorization before processing file deletion requests based on dir/path parameters, allowing path traversal or direct file deletion without proper authentication checks. This is classified as CWE-862 (Missing Authorization), indicating the application performs an action but does not verify that the user has permission to perform that action. The attack vector is network-based with no interaction required (NUI per CVSS 4.0), suggesting the vulnerable endpoint is directly accessible over the network without user interaction.

RemediationAI

No vendor-released patch identified at time of analysis. Given Technostrobe's non-response to disclosure, organizations relying on HI-LED-WR120-G2 devices should implement network-level controls to restrict access to the vulnerable component: restrict SSH/HTTP(S) access to the device management interfaces using firewalls or network segmentation, disable remote file management features if not operationally necessary, and monitor file system access logs for unauthorized deletions. Consider contacting Technostrobe directly to escalate the unresponded disclosure or evaluate replacement with a vendor maintaining active security support. Reference: https://vuldb.com/vuln/355344 and public disclosure at https://github.com/shiky8/my--cve-vulnerability-research/blob/main/my_VulnDB_cves/CVE-TECHNOSTROBE-06-FileDeletion.md.