Pugongying X5 Pro CVE-2026-120223

Exploitation requires an existing low-privilege ('ordinary user') account on the Oray Pugongying X5 Pro router (PR:L) - it is not unauthenticated. The specific trigger is the weak session-ID generation in the session_get function of session.lua (the Session ID Handler), where manipulation of the _user argument yields insufficiently random values that let an authenticated user predict another user's session ID and recover their password. Limiting factors: the attack is rated high complexity (AC:H) and is described by the reporter as 'difficult', no fixed version is identified, and exploitation depends on holding valid low-privilege credentials on the device; there is no availability or integrity impact, only limited confidentiality.

This is a low-priority issue despite being remotely reachable. The CVSS 4.0 base score is only 1.3, consistent with its vector (AV:N/AC:H/AT:N/PR:L/UI:N) and limited impact (VC:L, with VI:N/VA:N and no subsequent-system impact). The high attack complexity (AC:H), the requirement for existing low-level privileges (PR:L), and the reporter's own characterization that exploitability is 'difficult' all point to a narrow, hard-to-pull-off weakness rather than a broadly dangerous flaw. The only confidentiality impact is low (predictable session IDs can expose another ordinary user's password, per the referenced PoC writeup). Exploitation maturity is Proof-of-Concept (E:P), and the vuln.today decision label is 'monitor'. This is NOT in CISA KEV and is not confirmed as actively exploited. No EPSS score was provided in the input, so real-world exploitation probability cannot be quantified here. The signals are internally consistent (low CVSS, PoC-only maturity, 'monitor' decision, high complexity) - there is no high-CVSS-vs-low-risk conflict; this is a genuinely low-risk, high-complexity information-disclosure issue in a niche product. A caveat: the reporter is a single source (VulDB) and the vendor did not respond, so affected-version and fix data are unconfirmed.

An attacker who already holds a low-privilege (ordinary user) account on an Oray Pugongying X5 Pro router (<=7.6.1) exploits the insufficiently random session IDs generated by session_get in session.lua to predict another user's session identifier and thereby recover that user's password, as described in the referenced PoC writeup. Because attack complexity is rated high and the reporter describes exploitation as difficult, this requires favorable conditions and is not reliably repeatable. A public PoC reference exists; it is not verified as working exploit code.