Oray Pugongying X5 Pro: Improper authorization in API Authorization
Summary
The API Authorization component (run_apis_by_json/run_async_task) of the Oray Pugongying X5 Pro router firmware up to 7.6.1 does not enforce authorization correctly. A remote attacker with a valid login, even a restricted account, may be able to perform privileged actions such as a factory reset, according to a third-party write-up. A public exploit is reported, but the vendor did not respond to the disclosure.
Affected
- Oray Pugongying X5 Pro firmware 7.6.0
- Oray Pugongying X5 Pro firmware 7.6.1
- Earlier versions: up to 7.6.1 according to the CVE description
Fixed in
Unknown.
Workaround
- No vendor workaround documented.
- Restrict the management interface to trusted hosts or a VPN with strong authentication.
- Disable remote/WAN management.
Exploitation
- Public exploit: reported in the disclosure and listed by OffSeq.
- In the wild: no confirmed exploitation found.
- CVSS 4.0 score: 8.6 per the CVE data; VulDB lists 9.9 and OffSeq lists 9.4.
Our recommendation
- Check whether the device is in use and whether remote management is enabled.
- Disable WAN-side management and limit admin access to trusted hosts.
- Review and remove unused or restricted accounts.
- Monitor for unexpected configuration changes or resets and keep a current configuration backup.
- Without a vendor firmware fix, plan replacement or isolation of affected devices.
- Assess the whole firmware line, as many related CVEs were published in late October 2026.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE-2026-120224 vuldb.com
- VulDB entry 429583 vuldb.com
- Third-party write-up (Notion) app.notion.com
- OffSeq Radar CVE-2026-120224 radar.offseq.com
- VulDB submission 1005085 (related CVEs) vuldb.com
- OpenCVE CVE-2026-116237 (mitigation advice for sibling CVE) app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:21.
Original description (NVD)
A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.