Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-120225— Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal

Quick assessment

Affected

Oray Pugongying X5 Pro

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Oray 蒲公英 X5 Pro（版本 7.6.1 及以下）中发现一处安全弱点。该漏洞影响文件中的函数。由于该函数对参数处理不当，可导致相对路径遍历漏洞。攻击者可远程发起攻击。目前，相关利用代码已公开，可能被用于实际攻击。厂商已就此事在早期被联系，但至今未作出任何回应。

CVSS 9.1 · Critical Updated Nov 01, 2026

Possible ATT&CK Techniques 2 AI

T1565 · Data Manipulation T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

Vendor	Product	Version Range	Status
Oray	Pugongying X5 Pro	`7.6.0`	affected
		`7.6.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal

Source: CVE Program / CVE List V5

Vulnerability Description

A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function config_restore_ex of the file /etc/openwrt_release. This manipulation of the argument filename causes relative path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

相对路径遍历

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Oray	Pugongying X5 Pro	7.6.0	`cpe:2.3:a:oray:pugongying_x5_pro::::::::`

II. Public POCs for CVE-2026-120225

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120225

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-120225 (1)

CVE-2026-120225 | Oray Pugongying X5 Pro up to 7.6.1 /etc/openwrt_release config_restore_ex filename path traversal vdb-entry technical-description

Other References for CVE-2026-120225 (6)

https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Configuration-Restore-Filename-Traversal-Leads-to-Root-Code-Execution-3eb797159f158017a2cbe1732b7ffa6c exploit
https://vuldb.com/cve/CVE-2026-120225 third-party-advisory
https://vuldb.com/vuln/429584/cti signature permissions-required
https://vuldb.com/submit/1007547 third-party-advisory
https://vuldb.com/submit/1007551 third-party-advisory
https://vuldb.com/submit/1007550 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120225

Same Patch Batch · Oray · 2026-11-01 · 3 CVEs total

CVE-2026-120224	9.9 CRITICAL	Oray Pugongying X5 Pro API Authorization run_async_task improper authorization
CVE-2026-120223	3.1 LOW	Oray Pugongying X5 Pro Session ID session.lua session_get random values

IV. Related Vulnerabilities

Same product: Pugongying X5 Pro

Same vendor: Oray

Same weakness: CWE-23