CVE-2026-5574

CVE-2026-5574 is an authorization bypass vulnerability in the FsBrowseClean component's deletefile function affecting Technostrobe HI-LED-WR120-G2 version 5.5.0.1R6.03.30. The flaw allows manipulation of the dir/path argument to bypass access controls, potentially enabling unauthorized file deletion. The vulnerability can be exploited remotely without authentication or user interaction required. The vulnerability carries a CVSS v3.1 score of 6.5 (Medium), reflecting its network-accessible attack vector with low complexity and no privileges or interaction needed. The primary impacts are integrity and availability degradation through unauthorized file operations, though confidentiality remains unaffected. The FAUCET risk score of 45.0/100 indicates moderate organizational concern. Exploitation status shows no current active exploitation attempts in the wild, with no CISA KEV listing and an inactive Hot List status. However, the vulnerability has been publicly disclosed with exploit availability reported. The vendor demonstrated unresponsiveness to early disclosure notification, leaving organizations reliant on defensive measures or upgrades independent of vendor remediation efforts.