Which versions of Hi Led Wr120 G2 are affected by EUVD-2026-19087?

Technostrobe HI-LED-WR120-G2 devices running firmware 5.5.0.1R6.03.30 contain an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive endpoints and…

Is there a public PoC exploit available for EUVD-2026-19087?

Yes, a public proof-of-concept exploit is available for EUVD-2026-19087. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-19087?

Within 24 hours: Identify and inventory all Technostrobe HI-LED-WR120-G2 devices in your network; isolate affected devices from untrusted network segments if operationally feasible. Within 7 days: Implement network-level access controls restricting traffic to the /Technostrobe/ endpoint to authorized administrative systems only; apply strong firewall rules limiting inbound access to affected devices; consider disabling non-critical endpoints if supported by firmware. Within 30 days: Contact Technostrobe directly to escalate patch status; evaluate replacement with alternative LED control solutions that receive active vendor support; implement continuous monitoring of device endpoints for unauthorized access attempts.

Hi Led Wr120 G2 EUVD-2026-19087

Q: What is the CVSS score of EUVD-2026-19087?

EUVD-2026-19087 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5569 MEDIUM

Improper Access Control (CWE-284)

2026-04-05 VulDB

Authentication Bypass Hi Led Wr120 G2 Technostrobe

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 14:00 euvd

EUVD-2026-19087

Analysis Generated

Apr 05, 2026 - 14:00 vuln.today

CVE Published

Apr 05, 2026 - 13:15 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was found in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. Impacted is an unknown function of the file /Technostrobe/ of the component Endpoint. The manipulation results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper access controls in Technostrobe HI-LED-WR120-G2 firmware 5.5.0.1R6.03.30 enable unauthenticated remote attackers to bypass authentication mechanisms via the /Technostrobe/ endpoint, exposing multiple endpoints with low-level confidentiality, integrity, and availability impact. Publicly available exploit code exists demonstrating the authentication bypass (CVSS 7.3, EPSS data not provided). Vendor did not respond to coordinated disclosure attempts, leaving users at elevated risk without official remediation guidance.

Technical ContextAI

This vulnerability affects the Technostrobe HI-LED-WR120-G2, an LED lighting control device, at firmware version 5.5.0.1R6.03.30. The flaw is rooted in CWE-284 (Improper Access Control), indicating insufficient enforcement of authorization checks at the /Technostrobe/ endpoint. The CVSS vector shows network-based exploitation (AV:N) with low complexity (AC:L) requiring no privileges (PR:N) or user interaction (UI:N), suggesting a fundamental failure in access control implementation across multiple API endpoints or administrative functions. The affected component handles critical device configuration or management operations, and the lack of proper authentication/authorization checks allows unauthorized parties to interact with functionality that should be restricted. The device appears to be an industrial or commercial LED controller, typically deployed in building automation or signage systems where remote management is expected.

RemediationAI

No vendor-released patch has been identified at time of analysis, as Technostrobe did not respond to vulnerability disclosure attempts documented in VulDB submission 783322. Organizations operating affected HI-LED-WR120-G2 devices should implement immediate network-level compensating controls including isolating devices to dedicated management VLANs, restricting access to the /Technostrobe/ endpoint via firewall rules or web application firewall policies permitting only authorized management IP addresses, and disabling remote management capabilities if not operationally required. Monitor access logs for the /Technostrobe/ endpoint for unauthorized access attempts and consider replacing affected devices with alternative products from responsive vendors if the devices handle critical infrastructure functions. Consult the technical analysis at https://github.com/shiky8/my--cve-vulnerability-research/blob/main/my_VulnDB_cves/CVE-TECHNOSTROBE-01-BrokenAccessControl.md for specific endpoint details to inform detection rules. Organizations should periodically check https://vuldb.com/vuln/355339 for any vendor updates, though vendor engagement history suggests official patches are unlikely without public pressure or regulatory intervention.