A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 9.4 · orayNVD modified 2026-11-01 10:15
Affected (CPE criteria) 1
cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*
References 6
- https://vuldb.com/vuln/429583 vdb-entry, technical-description
- https://vuldb.com/vuln/429583/cti signature, permissions-required
- https://vuldb.com/cve/CVE-2026-120224 third-party-advisory
- https://vuldb.com/submit/1007541 third-party-advisory
- https://vuldb.com/submit/1007542 third-party-advisory
- https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Restricted-Account-Can-Invoke-Factory-Reset-through-the-JSON-Batch-AP-3eb797159f1580febfd2f0e1ee239352 exploit