Vulnerability details
CVE-2026-120224
Oray Pugongying X5 Pro
Oray Pugongying X5 Pro API Authorization run_async_task improper authorization
CVSS 4.0
9.4Critical
Official description
A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.4Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P |
| 9.9Critical | 3.1 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R |
| 9.9Critical | 3.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R |
| 9.0High | 2.0 | CVEProject cvelistV5 (CNA) (VulDB) | AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Oray | Pugongying X5 Pro | 7.6.0 | CVEProject cvelistV5 (CNA) |
| Oray | Pugongying X5 Pro | 7.6.1 | CVEProject cvelistV5 (CNA) |
References and advisories
6- https://vuldb.com/vuln/429583 vdb-entrytechnical-description
- https://vuldb.com/vuln/429583/cti signaturepermissions-required
- https://vuldb.com/cve/CVE-2026-120224 third-party-advisory
- https://vuldb.com/submit/1007541 third-party-advisory
- https://vuldb.com/submit/1007542 third-party-advisory
- https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Restricted-Account-Can-Invoke-Factory-Reset-through-the-JSON-Batch-AP-3eb797159f1580febfd2f0e1ee239352 exploit
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-11-01
- Last updated
- 2026-11-02
- State
- Published
- Assigner (CNA)
- VulDB
- Kolun priority
- 32 · Low
Exploit prediction (EPSS)
0.38%
Probability of exploitation in 30 days
32.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-285Improper Authorization
- CWE-266Incorrect Privilege Assignment