# CVE-2026-5570: Technostrobe HI-LED-WR120-G2 auth bypass in /LoginCB

Source: https://junglewise.ai/threats/cve-2026-5570-technostrobe-hi-led-wr120-g2-auth-bypass-in-logincb  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-05. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-5570 · Severity: high · CVSS 7.3 · Published 2026-04-05

A vulnerability exists in the Technostrobe HI-LED-WR120-G2, a controller used to manage aviation obstruction lighting on tall structures like towers. An attacker can bypass the login screen to gain unauthorized access to the device's configuration and light control panels. This could allow an unauthorized user to modify safety-critical lighting settings, potentially impacting aviation safety and regulatory compliance.

Technologies: [Technostrobe Hi-Led-Wr120-G2](https://junglewise.ai/threats/technologies/hi-led-wr120-g2), [Technostrobe Hi-Led-Wr120-G2 Firmware](https://junglewise.ai/threats/technologies/hi-led-wr120-g2-firmware). Vendors: [Technostrobe](https://junglewise.ai/threats/vendors/technostrobe).

## Quick answers

**Is CVE-2026-5570 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5570 being exploited in the wild.

**How severe is CVE-2026-5570?** High severity, with a CVSS score of 7.3, published 5 April 2026.

**Which products and versions are affected?** Technostrobe Hi-Led-Wr120-G2 5.5.0.1R6.03.30.

**Is there a fix for CVE-2026-5570?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5570 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-5570?** Check whether you run Technostrobe Hi-Led-Wr120-G2 or Technostrobe Hi-Led-Wr120-G2 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass vulnerability exists in Technostrobe HI-LED-WR120-G2 firmware version 5.5.0.1R6.03.30. The flaw is located in the index_config function within the /LoginCB file, where authentication is improperly enforced on the client side rather than the server side. By manipulating HTTP responses (e.g., using a proxy to modify a 'denied' response to 'success') or accessing specific endpoints directly, a remote, unauthenticated attacker can bypass the login mechanism. This grants access to the configuration panel and light control board. The vendor has reportedly not responded to disclosure attempts, and a public exploit exists.

## Affected products

- Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30

## Timeline

- 2026-04-05: disclosed: Vulnerability publicly disclosed via VulDB and GitHub.
- 2026-04-05: advisory

## References

- [https://github.com/shiky8/my--cve-vulnerability-research/blob/main/my_VulnDB_cves/CVE-TECHNOSTROBE-02-AuthBypass.md](https://github.com/shiky8/my--cve-vulnerability-research/blob/main/my_VulnDB_cves/CVE-TECHNOSTROBE-02-AuthBypass.md)
- [https://vuldb.com/submit/783323](https://vuldb.com/submit/783323)
- [https://vuldb.com/vuln/355340](https://vuldb.com/vuln/355340)
- [https://vuldb.com/vuln/355340/cti](https://vuldb.com/vuln/355340/cti)

## Related threats

- [Technostrobe HI-LED-WR120-G2 unauthenticated file deletion in FsBrowseClean](https://junglewise.ai/threats/cve-2026-5574-technostrobe-hi-led-wr120-g2-unauthenticated-file-deletion-in)
- [Technostrobe HI-LED-WR120-G2 unauthenticated file upload in /fs](https://junglewise.ai/threats/cve-2026-5573-technostrobe-hi-led-wr120-g2-unauthenticated-file-upload-in-fs)
- [Technostrobe HI-LED-WR120-G2 CSRF in web interface](https://junglewise.ai/threats/cve-2026-5572-technostrobe-hi-led-wr120-g2-csrf-in-web-interface)
- [Technostrobe HI-LED-WR120-G2 unauthenticated information disclosure in /fs](https://junglewise.ai/threats/cve-2026-5571-technostrobe-hi-led-wr120-g2-unauthenticated-information)
- [Technostrobe HI-LED-WR120-G2 broken access control in Endpoint](https://junglewise.ai/threats/cve-2026-5569-technostrobe-hi-led-wr120-g2-broken-access-control-in-endpoint)