How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability can be detected by attempting to interact with the vulnerable AJAX handler on the Technostrobe HI-LED-WR120-G2 device. Specifically, sending a crafted POST request to the device's embedded HTTP server targeting the FsBrowseClean component with the deletefile action and a controlled path parameter can reveal if the device is vulnerable.

A practical detection command is a curl POST request that tries to delete a harmless or test file, or checks for the presence of the vulnerable handler by observing the response.

• curl -X POST -H "Content-Type: application/x-www-form-urlencoded" --data 'ajax=FsBrowseClean&dir=/&path=/login.cfg&action=deletefile' http://<device-ip>/

If the device responds with "OK" and the file is deleted or the response indicates the handler processed the request without authentication, it confirms the vulnerability.

Useful 0 Not Useful 0

Can you explain this vulnerability to me?

CVE-2026-5574 is a security vulnerability in the Technostrobe HI-LED-WR120-G2 obstruction lighting controller, specifically in the deletefile function of the FsBrowseClean component. The vulnerability arises because the device's embedded HTTP server exposes an AJAX handler that allows unauthenticated remote attackers to delete arbitrary files by manipulating the path parameter without any authorization or path validation.

This means an attacker can send specially crafted POST requests to the device to delete critical system files, including configuration files, user credential stores, web interface files, and firmware update files, potentially causing denial of service or disabling important device functions.

Useful 0 Not Useful 0

What immediate steps should I take to mitigate this vulnerability?

Immediate mitigation steps include restricting access to the vulnerable device and its HTTP interface to trusted networks only, as the vulnerability allows unauthenticated remote file deletion.

Additionally, monitor and block suspicious POST requests targeting the AJAX handler with parameters ajax=FsBrowseClean and action=deletefile.

Longer-term remediation recommended by the vendor or security researchers includes:

• Enforce authentication on all AJAX handlers to prevent unauthenticated access.
• Restrict deletable file paths server-side to a safe directory to prevent arbitrary file deletion.
• Implement path canonicalization to prevent directory traversal attacks.
• Add audit logging for all file operations, including source IP, timestamp, filename, and action.
• Separate web content from system configuration files to prevent unauthorized access.

Useful 0 Not Useful 0

How can this vulnerability impact me? :

This vulnerability can have severe impacts including:

• Deletion of user credential files, which disables authentication and locks out legitimate users.
• Loss of telemetry and status visibility by deleting configuration files related to monitoring.
• Removal of web interface files, preventing management access to the device.
• Deletion of network configuration files, potentially making the device unreachable.
• Erasing firmware update files, which can prevent patching or recovery and may brick the device.
• Erasing log and audit files, enabling attackers to cover their tracks and evade detection.

Operationally, this can cause denial of service to aviation safety lights, leading to outages that may last hours or days, risking pilot safety and causing regulatory penalties.

Useful 0 Not Useful 0

How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

The vulnerability in the Technostrobe HI-LED-WR120-G2 device allows unauthenticated remote attackers to delete critical system files, including configuration, authentication, and log files. This can lead to denial of service and loss of safety functions in aviation obstruction lighting systems.

Operationally, this impacts compliance with aviation safety regulations such as FAA AC 70/7460-1M, ICAO Annex 14, and Transport Canada standards, as the malfunction or disabling of safety lights risks pilot safety and may result in regulatory penalties or loss of operating licenses.

While the provided information does not explicitly mention GDPR, HIPAA, or other data protection regulations, the ability to delete log and audit files could hinder forensic investigations and incident response, potentially affecting compliance with regulations that require audit trails and data integrity.

Useful 0 Not Useful 0