EUVD-2026-114831
GHSA-6494-g389-mxj7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with restricted router account
-
DeliveryCraft JSON batch API request
-
ExploitBypass per-function authorization in run_apis_by_json
-
ExecutionInvoke privileged operation (e.g. factory reset)
-
ImpactWipe configuration / disrupt device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated low-privilege ('restricted') account on the router and network reachability to its API Authorization interface, specifically the JSON batch endpoint run_apis_by_json/run_async_task on Oray Pugongying X5 Pro versions up to 7.6.1. No user interaction is needed (UI:N). The limiting factors are the PR:L requirement (valid restricted credentials must be obtained first) and the constrained deployment footprint of this specific device; no non-default configuration is indicated by the sources. No vendor fix is available, so exposure persists until mitigated by restricting account/API access. |
| Impact | The VulDB-assigned CVSS 4.0 base score is 8.6 (High), reflecting a network-reachable (AV:N), low-complexity (AC:L) improper-authorization flaw requiring only a low-privilege account (PR:L) and no user interaction, with high impact claimed across confidentiality, integrity and availability. The exploit maturity is Proof-of-Concept (E:P), and the multi-source intelligence lists a public PoC reference (not verified as working exploit code) describing a restricted account invoking a factory reset via the JSON batch API. There is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation - the signals indicate a disclosed, demonstrable weakness rather than a mass-exploited one. The vuln.today decision label is 'this_week' (priority, not 'act_now'/'emergency'), which aligns with a serious-but-not-emergency posture. The most significant aggravating factor is that the vendor was contacted but did not respond and no fixed version is available, leaving affected owners without a patch. Tempering the overall real-world risk is the product's limited deployment footprint (a niche Chinese SMB VPN router) and the authentication prerequisite (PR:L). Net: a real, patch-less priority for organizations running this specific device, but not a broad internet-wide emergency. |
| Exploit ScenarioDerived | An attacker who already holds a restricted/low-privilege account on an Oray Pugongying X5 Pro router (version up to 7.6.1) sends a crafted JSON batch request to the run_apis_by_json/run_async_task endpoint of the API Authorization component. Because per-function authorization is not enforced on the batch API, the restricted account can invoke privileged operations - the public PoC reference specifically demonstrates triggering a factory reset. A public PoC reference exists but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Nov 01, 2026
Improper authorization in Oray Pugongying X5 Pro routers (up to and including 7.6.1) lets an authenticated but low-privilege 'restricted' account reach privileged API functionality through the run_apis_by_json/run_async_task JSON batch dispatcher, and the public write-up demonstrates a restricted account invoking a factory reset. Exploitation requires valid restricted credentials plus network reachability to the device's API Authorization interface, with no user interaction needed, and results in high confidentiality, integrity and availability impact (VulDB CVSS 4.0 score 8.6; our CVSS 3.1 assessment is 8.8). No vendor patch is available since Oray did not respond to the disclosure; a public proof-of-concept reference exists but is not verified as working exploit code, there is no CISA KEV entry confirming active exploitation, and no EPSS score was supplied, with prioritization set to 'this week'.
Earlier versions of this analysis (1)
Improper authorization in the JSON batch API of Oray's Pugongying X5 Pro router (versions up to 7.6.1) allows an authenticated low-privilege ('restricted') account to invoke privileged functions it should not be able to call - the public PoC reference demonstrates triggering a factory reset. Exploitation requires a valid restricted account/session and network reachability to the device's management API endpoint (run_apis_by_json/run_async_task); it is not an unauthenticated attack. A public PoC reference exists but is not verified as working exploit code, no CISA KEV listing or confirmed active exploitation is present, and the vendor was contacted but did not respond, so no vendor patch has been released despite CVSS 4.0 scoring 9.4 and a near-term priority (act_now) rating.
RemediationAI
No vendor-released patch was identified at the time of analysis: Oray was contacted about the disclosure and did not respond, so firmware 7.6.1 and earlier should be treated as unfixed and no upgraded build number can be cited. Until a vendor fix appears, the assessment calls for reducing exposure by restricting account and API access: audit and minimize the number of 'restricted' accounts on the device, remove or disable unused low-privilege logins (the trade-off is loss of delegated access for staff or tenants who relied on them), and limit network reachability to the API Authorization interface so that run_apis_by_json/run_async_task cannot be called from untrusted networks - place the management interface behind an administrative VLAN or a restricting firewall/ACL and remove any WAN-side management exposure, accepting that remote administration then requires a VPN or jump host. Monitor device configuration for unexpected factory resets or configuration changes originating from low-privilege sessions, and re-check https://vuldb.com/vuln/429583 and https://vuldb.com/cve/CVE-2026-120224 for an updated advisory or fixed firmware before restoring any broadened access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-285 (Improper Authorization): the API Authorization component of the Pugongying X5 Pro firmware does not enforce that the account invoking a function actually holds the privilege that function requires. The affected surface is the JSON batch dispatch path implemented by run_apis_by_json/run_async_task, which routes multiple API operations in a single request; the public write-up titled 'Restricted Account Can Invoke Factory Reset through the JSON Batch API' shows that a low-privilege account can drive at least one privileged operation (factory reset) through that dispatcher. The precise enforcement gap inside the dispatcher is not described in the available sources, and the CPE cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:* confirms the affected product line is the Oray Pugongying (Pgyer) X5 Pro router itself through firmware 7.6.1, an internet-facing small-business router/VPN appliance whose management API is typically reachable over the LAN and, in common deployments, from the WAN side as well. Because the CVSS vector carries PR:L, the flaw is post-authentication: the attacker must already hold a restricted-level account, so the practical escalation path is either credential compromise of a low-privilege user or abuse by an insider/tenant of the device, not pre-auth access.
Know when Pugongying X5 Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Remote, low-complexity authorization bypass usable by an authenticated restricted account (PR:L), granting access to privileged batch API functions (factory reset) that fully compromise integrity and availability and expose configuration.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Technical POC Analysis
Evidence note: the only supplied source is a Notion link that returns "Notion JavaScript must be enabled in order to get access" - no article body, no PoC code, no HTTP request/response, no patch dif…
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
CVE-2026-120224 is a high-severity improper authorization flaw in Oray Pugongying X5 Pro routers (up to 7.6.1) that allows an authenticated low-privilege 'restricted' user to invoke privileged API functions, including factory reset, via the JSON batch dispatcher. This puts organizations relying on these routers at risk of full device compromise, network disruption, and data loss, though exploitation requires valid restricted credentials and network access to the device's API interface. Leadership should prioritize remediation because a malicious insider or compromised low-privilege account could easily disrupt operations and exfiltrate sensitive data.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the device's API interface to trusted management networks only; disable unnecessary API features if possible; enforce strong authentication and least privilege for restricted accounts; monitor for anomalous API calls and factory reset events; consider network segmentation or device replacement if risk is unacceptable.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Pugongying X5 Pro
View allCRLF injection in the SNMP Handler of Oray Pugongying X5 Pro 7.6.1 lets a low-privileged authenticated user inject newli
CRLF injection in the ser2net serial-handling component of Oray Pugongying X5 Pro 7.6.1 lets a network-positioned attack
Relative path traversal in the configuration-restore routine (config_restore_ex) of Oray Pugongying X5 Pro firmware up t
CRLF injection in the Dnsmasq-related DNS group configuration of Oray Pugongying X5 Pro 7.6.1 can let an attacker with a
A CRLF injection (CWE-93) in the L2TP Authentication component of the Oray Pugongying X5 Pro router running firmware 7.6
CRLF injection in the IPsec Policy Handler of Oray Pugongying X5 Pro 7.6.1 allows an authenticated high-privilege admini
CRLF injection in the Dnsmasq configuration path of Oray Pugongying X5 Pro 7.6.1 lets a user who already holds administr
Unrestricted file upload in the PPPoE WAN Setting Handler of Oray Pugongying X5 Pro 7.6.1 lets an attacker who already h
Predictable session-ID generation in Oray Pugongying X5 Pro up to 7.6.1 lets an authenticated ordinary user recover anot
Exploit-DB