CVE-2026-120225criticalCWE-22CWE-23

CVE-2026-120225: falha crítica em Oray Pugongying X5 Pro

Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Pugongying X5 Pro

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

48Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 9.4epss 0.7%
A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function config_restore_ex of the file /etc/openwrt_release. This manipulation of the argument filename causes relative path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Produtos afetados
Oray · Pugongying X5 Pro
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Oray Pugongying X5 Pro

No mesmo produto, das mais perigosas para as menos.

CVE-2026-116235CRITICALOray Pugongying X5 Pro L2TP Authentication crlf injectionEPSS 0.6%CVE-2026-116234CRITICALOray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injectionEPSS 0.5%CVE-2026-116233CRITICALOray Pugongying X5 Pro Dnsmasq crlf injectionEPSS 0.5%CVE-2026-116232CRITICALOray Pugongying X5 Pro SNMP snmp_set crlf injectionEPSS 0.4%CVE-2026-116231CRITICALOray Pugongying X5 Pro Ser2net crlf injectionEPSS 0.4%CVE-2026-116236HIGHOray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted uploadEPSS 0.4%