This vulnerability in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30 arises from missing authorization in the deletefile function within the FsBrowseClean component. By manipulating the dir/path argument remotely, an attacker can bypass authorization controls. The issue has been publicly disclosed, but no official remediation or patch is currently available from the vendor. The CVSS 4.0 base score is 6.9, indicating medium severity, with network attack vector, no privileges required, no user interaction, and limited impact on confidentiality and availability.

An unauthenticated remote attacker can exploit this vulnerability to perform unauthorized deletion of files by manipulating the directory or path argument in the affected function. This could lead to partial loss of data or disruption of service on the affected device. There is no evidence of active exploitation in the wild, and the impact is limited to the affected version 5.5.0.1R6.03.30 of the product.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing compensating controls such as network-level restrictions to limit access to the affected device and monitor for suspicious activity related to file deletion. Stay alert for any future vendor advisories or patches addressing this vulnerability.