Vulnerability record/PUBLISHED/Published Nov 1, 2026 10:45:20 UTC
CVE-2026-120225
A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function config_restore_ex of the file /etc/openwrt_release. This manipulation of the argument filename causes relative path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Base score9.4/ 10
SeverityCriticalCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityCritical
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredHighPR
User interactionNoneUI
Vulnerable system confidentialityHighVC
Vulnerable system integrityHighVI
Vulnerable system availabilityHighVA
Subsequent system confidentialityHighSC
Subsequent system integrityHighSI
Subsequent system availabilityHighSA
Exploit maturityProof of conceptE
CVSS vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:PCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulDB
Last updatedNov 1, 2026 10:45:20 UTC
PublishedNov 1, 2026 10:45:20 UTC
ReservedOct 31, 2026 19:21:00 UTC
Credits
- FirmAgent (VulDB User)
- VulDB CNA Team