Oray Pugongying X5 Pro Router Improper Authorization Vulnerability (CVE-2026-120224)
Executive & SecOps Summary
SECOPS ASSESSMENTOray Pugongying X5 Pro router versions up to and including 7.6.1
A restricted account can bypass authorization checks to remotely invoke sensitive administrative functions, such as a factory reset, via manipulated JSON batch API requests
Restrict external access to the router's management interface and apply temporary access control lists (ACLs) until an official patch is released
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
As the vendor has not yet responded to the disclosure, an official patch is currently unavailable. Once a patch is released, administrators should immediately upgrade the firmware. Below is an example of how to apply a firmware update via CLI:
# Download and apply the official firmware update (once available)
curl -O https://pgy.oray.com/download/firmware/pgy-x5-pro-latest.bin
# Flash the firmware using the router's system upgrade utility
sysupgrade -v pgy-x5-pro-latest.bin2. Temporary Workaround & Hardening Configuration
Until a patch is provided, restrict access to the router's management interface and block external access to the vulnerable API endpoints.
# Restrict management access (ports 80/443) to trusted internal IP ranges only
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
# Block access to the vulnerable API endpoints via Nginx reverse proxy configuration
# Add the following block to your nginx.conf:
# location ~* /(run_apis_by_json|run_async_task) {
# deny all;
# }3. Log Audit & IoC Verification Commands
Audit the router's web server logs to detect unauthorized invocations of the vulnerable API endpoints.
# Search access logs for suspicious requests targeting the vulnerable endpoints
grep -E 'run_apis_by_json|run_async_task' /var/log/lighttpd/access.log /var/log/nginx/access.log
# Verify the current firmware version of the router
cat /etc/openwrt_release | grep -i 'DISTRIB_RELEASE'Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
A critical security flaw has been identified in the API Authorization component of the Oray Pugongying X5 Pro router, specifically within the run_apis_by_json and run_async_task functions. The root cause is improper authorization (CWE-285, CWE-266), where the system fails to validate whether the requesting user possesses the necessary privileges to execute high-impact administrative tasks.
2. Exploitation Mechanics & Attack Scenario
An attacker with low-privileged or restricted account access can exploit this vulnerability by sending a crafted JSON batch request to the run_apis_by_json or run_async_task endpoints. Because the backend fails to enforce strict privilege separation, the router processes the nested administrative commands (such as triggering a factory reset) under the context of an elevated user. Public exploits are currently available, increasing the risk of active exploitation.
3. Infrastructure & Business Impact
With a CVSS score of 9.9 (Critical), this vulnerability poses a severe threat to network infrastructure. Successful exploitation allows remote attackers to trigger a factory reset, leading to a complete denial of service (DoS) and loss of network connectivity for the entire organization. It may also allow attackers to reconfigure the gateway to facilitate lateral movement.
Official Vendor Advisories & References
A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Frequently Asked SecOps Questions (CVE-2026-120224)
FAQQ1. How critical is CVE-2026-120224 and is it actively exploited in the wild?
CVE-2026-120224 is rated CVSS 9.9 (CRITICAL) with a 30-day EPSS exploitation probability of 0.4%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-120224?
Primary impacted vendors include oray across pugongying x5 pro. Scope summary: Oray Pugongying X5 Pro router versions up to 7.6.1 (affecting API Authorization component)
Q3. What temporary mitigations or workarounds exist for CVE-2026-120224 before patching?
[Mitigation] Restrict external access to the router's management interface and apply temporary access control lists (ACLs) until an official patch is released Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-120224
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (oray)
View Category →Oray Pugongying X5 Pro Router config_restore_ex Path Traversal Remote Code Execution (CVE-2026-120225)
[Affected Scope] Oray Pugongying X5 Pro routers up to version 7.6.1
Arista VeloCloud Orchestrator (VCO) Remote Code Execution and Privilege Escalation (CVE-2026-93952)
[Affected Scope] Arista VeloCloud Orchestrator (VCO) On-premise deployments.
Cisco Identity Services Engine (ISE) Critical Authentication Bypass Vulnerability (CVE-2026-76460)
[Affected Scope] Cisco Identity Services Engine (ISE) web-based management interface and API endpoints.
SonicWall SMA1000 Work Place Pre-Authentication Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-83548)
[Affected Scope] SonicWall SMA1000 Series Appliance Work Place interface
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.