Pugongying X5 Pro EUVD-2026-114832

Exploitation requires authenticated access at the privilege level able to invoke the router's configuration-restore function (config_restore_ex), consistent with PR:H in the CVSS vector - this is an operator/admin-gated feature, not a default-open endpoint. The specific prerequisite is the ability to call the config restore with a controllable 'filename' argument, into which the attacker injects relative path-traversal sequences; the referenced advisory ties this to /etc/openwrt_release and root code execution. Limiting factors: the attacker must first obtain valid router credentials or an existing admin session, and the attack is bounded to devices running vulnerable firmware (up to 7.6.1). No user interaction is required (UI:N). The precise mechanism by which the traversal escalates to code execution is described only in the external exploit reference and is not detailed in the CVE text itself.

This is a genuine but conditional risk rather than a drop-everything emergency, and the signals are mostly consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) describes network-reachable, low-complexity exploitation that nonetheless requires high privileges (PR:H) - meaning the attacker must already be authenticated to the router, most plausibly as an administrator who can invoke the configuration-restore feature. The exploit-maturity metric is E:P (Proof-of-Concept), aligning with the input: a public PoC reference exists but is not verified as working exploit code. There is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_week', i.e. patch on a normal priority cadence, not act_now/emergency. The headline 8.5 (High) score is driven by the full VC/VI/VA:H plus SC/SI/SA:H impact (the referenced advisory frames the path traversal as leading to root code execution), but that impact is gated behind the PR:H authentication requirement. Net: credible authenticated-to-root escalation on the device with a public PoC reference, but the privilege prerequisite and absence of KEV/EPSS data materially lower real-world urgency compared to an unauthenticated RCE. Note a tension worth verifying: the 4.0 vector asserts a scope change (SC/SI/SA:H) while the flaw is a single-device config-restore traversal, so whether impact truly extends to a subsequent system is unconfirmed from the available data.

An attacker with administrative access to an Oray Pugongying X5 Pro router (≤7.6.1) uses the configuration-restore feature, supplying a crafted 'filename' argument to the config_restore_ex function that contains relative path-traversal sequences. Because the filename is not sanitized, the restore operation writes to or reads from an arbitrary path (the advisory cites /etc/openwrt_release), which the referenced writeup describes as leading to root code execution on the device. A public PoC reference exists but is not verified as working exploit code, and exploitation requires prior authentication at the privilege level that can trigger a config restore.