Oray Pugongying X5 Pro: Path traversal in configuration restore
Summary
The Oray Pugongying X5 Pro router firmware up to version 7.6.1 contains a relative path traversal in the function config_restore_ex, which processes the filename argument during configuration restore. An attacker with high privileges on the network can use a crafted filename to access files outside the intended directory. A public proof-of-concept exists, and the vendor did not respond to the early disclosure. No fixed firmware is known.
Affected
- Oray Pugongying X5 Pro up to 7.6.1 (VulDB)
- Versions 7.6.0 and 7.6.1 are listed in the CVE record
- Exact full list of affected versions not confirmed by the vendor
Fixed in
Unknown. No fixed firmware has been found.
Workaround
- No vendor mitigation available.
- Keep the web management interface off the WAN and remove port forwards to it.
- Restrict management access to a management VLAN or specific IP addresses.
- Change the management password and review who has it.
- Review configuration backups before restoring them and check whether the device has been restored from an unknown file.
Exploitation
- Public proof-of-concept available (VulDB status: Proof-of-Concept).
- No confirmed exploitation in the wild found at the time of research.
- Not listed in CISA KEV as far as found.
- Requires high privileges according to the CVSS vector (PR:H).
Our recommendation
- Check whether the device is reachable from untrusted networks, including the internet, and close any exposure.
- Restrict admin access to trusted management networks only.
- Replace or isolate the device if no fixed firmware is available and access cannot be restricted.
- Check the vendor firmware page regularly for a fixed build and apply it as soon as it is released.
- Monitor the device for unexpected configuration changes or restores.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB entry for CVE-2026-120225 vuldb.com
- VulDB CVE page vuldb.com
- OffSeq threat page for CVE-2026-120225 radar.offseq.com
- Public write-up for CVE-2026-120225 (Notion) app.notion.com
- Affected version list (third-party, related CVE) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:21.
Original description (NVD)
A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function config_restore_ex of the file /etc/openwrt_release. This manipulation of the argument filename causes relative path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
NVD references (7)
- https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Configuration-Restore-Filename-Traversal-Leads-to-Roo…
- https://vuldb.com/cve/CVE-2026-120225
- https://vuldb.com/submit/1007547
- https://vuldb.com/submit/1007550
- https://vuldb.com/submit/1007551
- https://vuldb.com/vuln/429584
- https://vuldb.com/vuln/429584/cti
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.