CVE-2026-5572

CVE-2026-5572 is a cross-site request forgery (CSRF) vulnerability affecting Technostrobe HI-LED-WR120-G2 version 5.5.0.1R6.03.30. The flaw resides in an unidentified function within the product and allows an attacker to perform unauthorized actions on behalf of authenticated users. The vulnerability has a CVSS 3.1 score of 4.3 (Medium severity) with a network-based attack vector requiring no privileges but necessitating user interaction. The attack has low complexity and results in integrity impact with no confidentiality or availability compromise. This modest severity rating is reflected in the low EPSS score of 0.000050000, indicating minimal real-world exploitation likelihood. Exploit code has been released publicly, though there is currently no evidence of active exploitation in the wild. The vulnerability is not tracked on the CISA KEV catalog and remains inactive on threat intelligence hot lists. Notably, the vendor declined to engage with the disclosure process, leaving this vulnerability unpatched and presenting an ongoing risk to deployed instances.