What’s Vulnerable › Vulnerabilities
CVE-2026-120224: Oray Pugongying X5 Pro API Authorization run_async_task improper authorization
- Severity: critical (CVSS 9.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- Public exploit or detection template: none known
- Published: 2026-11-01 · updated 2026-11-01
- Weakness: CWE-266
Description
A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Summary
CVE-2026-120224 is a critical improper authorization flaw (CVSS 9.9) in the run_apis_by_json/run_async_task function of the API Authorization component in Oray Pugongying X5 Pro up to version 7.6.1. It can be exploited remotely, allowing attackers to bypass authorization controls. A public exploit has been released and may be used in attacks; the vendor did not respond to the disclosure. Users should update to a fixed version once available and, in the meantime, restrict remote access to the device's API.
CVE-2026-120224 هو ثغرة تفويض غير صحيح حرجة (CVSS 9.9) في الدالة run_apis_by_json/run_async_task ضمن مكوّن API Authorization في Oray Pugongying X5 Pro حتى الإصدار 7.6.1. يمكن استغلالها عن بُعد، مما يسمح للمهاجمين بتجاوز ضوابط التفويض. تم نشر استغلال علني وقد يُستخدم في الهجمات، ولم يستجب المورّد للإفصاح. يُنصح المستخدمون بالترقية إلى إصدار مُصلح عند توفره، وبحصر الوصول البعيد إلى واجهة API للجهاز في هذه الأثناء.
Affected products
- Oray Pugongying X5 Pro: 7.6.0, 7.6.1
References
- https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Restricted-Account-Can-Invoke-Factory-Reset-through-the-JSON-Batch-AP-3eb797159f1580febfd2f0e1ee239352
- https://vuldb.com/cve/CVE-2026-120224
- https://vuldb.com/submit/1007541
- https://vuldb.com/submit/1007542
- https://vuldb.com/vuln/429583
- https://vuldb.com/vuln/429583/cti
Get alerted when CVE-2026-120224 or the next vulnerability affects your stack