CVE-2026-5574
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Missing authorization in the deletefile function of the FsBrowseClean component in Technostrobe HI-LED-WR120-G2 (version 5.5.0.1R6.03.30). Manipulation of the dir/path argument allows remote file deletion.
Risk Assessment
A remote attacker can delete arbitrary files on the system, potentially leading to data loss or device instability.
Recommendation
Contact the vendor for a patch; temporarily restrict access to the device.
Original NVD description (English source)
A security vulnerability has been detected in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. Affected is the function deletefile of the component FsBrowseClean. The manipulation of the argument dir/path leads to missing authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.