CVE-2026-5571

MediumPublic PoC

Published: 05 April 2026

Published

05 April 2026

Modified

30 April 2026

KEV Added

—

Patch

—

CVSS Score 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Score 0.0004 11.9th percentile

Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5571 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Technostrobe Hi-Led-Wr120-G2 Firmware. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AU-13 (Monitoring for Information Disclosure).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations for logical access to prevent unauthorized manipulation of the File argument in the Configuration Data Handler leading to information disclosure.

AU-13 Monitoring for Information Disclosure good match

detect

Monitors the system for information disclosure through anomalous access to the /fs component, enabling identification of exploitation attempts.

SI-10 Information Input Validation good match

prevent

Validates inputs to the Configuration Data Handler function to block manipulation of the File argument that exposes sensitive configuration data.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

Why these techniques?

The remote unauthenticated info disclosure via File arg manipulation in a public-facing Configuration Data Handler directly maps to T1190 (Exploit Public-Facing Application) for initial exploitation and facilitates T1005 (Data from Local System) by enabling unauthorized access to sensitive configuration data.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability was identified in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. The impacted element is an unknown function of the file /fs of the component Configuration Data Handler. Such manipulation of the argument File leads to information disclosure. It is possible to launch…

the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Deeper analysisAI

CVE-2026-5571 is an information disclosure vulnerability affecting the Technostrobe HI-LED-WR120-G2 device running firmware version 5.5.0.1R6.03.30. The issue resides in an unknown function within the /fs file of the Configuration Data Handler component, where manipulation of the File argument enables unauthorized access to sensitive data. Classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-284 (Improper Access Control), it has a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating medium severity with low confidentiality impact and no effects on integrity or availability.

The vulnerability can be exploited remotely by unauthenticated attackers with no privileges or user interaction required, leveraging low attack complexity over the network. Successful exploitation allows disclosure of configuration data or other sensitive information from the affected component, potentially aiding further attacks on the device or network. A public exploit is available, increasing the risk of widespread use.

Advisories from VULDB and a related GitHub repository detail the vulnerability but report no vendor response despite early notification, with no patches or mitigations issued. Security practitioners should isolate affected devices, monitor for anomalous /fs file access, and restrict network exposure until firmware updates are available. References include https://github.com/shiky8/my--cve-vulnerability-research/blob/main/my_VulnDB_cves/CVE-TECHNOSTROBE-03-InfoDisclosure.md, https://vuldb.com/submit/783324, https://vuldb.com/vuln/355341, and https://vuldb.com/vuln/355341/cti.

The public availability of the exploit suggests potential for active exploitation in the wild, particularly against unpatched Technostrobe HI-LED-WR120-G2 deployments in environments like lighting or industrial control systems.