CVE-2026-5573

CVE-2026-5573 affects Technostrobe HI-LED-WR120-G2 version 5.5.0.1R6.03.30 and involves an unrestricted file upload vulnerability in the /fs endpoint. The flaw exists in an unknown function that fails to properly validate the "cwd" (current working directory) argument, allowing attackers to bypass upload restrictions. This vulnerability carries a CVSS score of 7.3 (HIGH) with a network-based attack vector requiring no authentication or user interaction, making it relatively straightforward to exploit. The vulnerability is currently not listed on the Known Exploited Vulnerabilities (KEV) catalog and shows no signs of active exploitation in the wild, though proof-of-concept code has been publicly disclosed. The vendor failed to respond to early disclosure attempts, limiting the availability of official patches and increasing the risk of adoption by threat actors once awareness spreads.