Oray Pugongying X5 Pro Router config_restore_ex Path Traversal Remote Code Execution (CVE-2026-120225)
Executive & SecOps Summary
SECOPS ASSESSMENTOray Pugongying X5 Pro routers up to version 7.6.1
Remote authenticated attackers with high privileges can exploit path traversal to overwrite arbitrary files and execute code with root privileges
Restrict access to the management interface immediately and isolate the device from untrusted networks
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
As the vendor has not responded to the vulnerability disclosure, no official security patch is currently available. Administrators must restrict management access immediately. Once a patch is released, verify and upgrade the firmware using the following commands:
# Check current firmware version on the device
cat /etc/openwrt_release | grep -i 'DISTRIB_RELEASE'
# Example command to manually apply firmware once released (Placeholder)
# wget -O /tmp/firmware.bin 'http://update.oray.com/pgy/x5pro/latest_patch.bin'
# sysupgrade -v /tmp/firmware.bin2. Temporary Workaround & Hardening Configuration
Block all external WAN-side access to the router's web administration interface (ports 80, 443, 8080) and SSH service. Implement strict Access Control Lists (ACLs) to allow access only from trusted internal management subnets.
# Block external WAN access to web admin ports using iptables
# Replace eth0 with your actual WAN interface
iptables -A INPUT -i eth0 -p tcp --dport 80 -j DROP
iptables -A INPUT -i eth0 -p tcp --dport 443 -j DROP
# Allow access only from a trusted administrator IP (e.g., 192.168.1.100)
iptables -A INPUT -p tcp -s 192.168.1.100 --dport 80 -j ACCEPT3. Log Audit & IoC Verification Commands
Inspect web server access logs for suspicious requests targeting the config_restore_ex endpoint containing directory traversal sequences.
# Scan web access logs for path traversal attempts targeting the vulnerable function
LOG_PATH='/var/log/lighttpd/access.log'
if [ -f '$LOG_PATH' ]; then
echo '[+] Scanning logs for CVE-2026-120225 indicators...'
grep -E 'config_restore_ex.*(\.\.\/|\.\.%2f)' '$LOG_PATH'
else
echo '[-] Log file not found. Please verify the web server log path.'
fiStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
A critical vulnerability has been identified in the config_restore_ex function within /etc/openwrt_release on Oray Pugongying X5 Pro routers. The application fails to properly sanitize and validate the filename parameter during configuration restoration operations. This lack of input validation leads to a relative path traversal vulnerability (CWE-22/CWE-23), allowing arbitrary file write and extraction outside the intended directory.
2. Exploitation Mechanics & Attack Scenario
An attacker with administrative access can initiate this exploit remotely. By crafting a malicious configuration restore request where the filename parameter contains directory traversal sequences (e.g., ../../), the attacker can force the system to extract files into sensitive system directories. Overwriting critical startup scripts (such as /etc/rc.local) or cron jobs allows the attacker to achieve arbitrary remote code execution (RCE) with root privileges upon system reboot or task execution.
3. Infrastructure & Business Impact
Since these devices are primarily deployed as SD-WAN routers for enterprise VPN and remote branch connectivity, a compromise of this device poses a severe threat. Attackers can leverage root access to establish a persistent foothold, perform lateral movement within the internal corporate network, sniff transit traffic, or launch secondary internal attacks, severely impacting business operations and data confidentiality.
Official Vendor Advisories & References
A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function config_restore_ex of the file /etc/openwrt_release. This manipulation of the argument filename causes relative path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Frequently Asked SecOps Questions (CVE-2026-120225)
FAQQ1. How critical is CVE-2026-120225 and is it actively exploited in the wild?
CVE-2026-120225 is rated CVSS 9.1 (CRITICAL) with a 30-day EPSS exploitation probability of 0.7%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-120225?
Primary impacted vendors include oray across pugongying x5 pro. Scope summary: Oray Pugongying X5 Pro routers running firmware version 7.6.1 and below (No official patch available due to vendor non-responsiveness)
Q3. What temporary mitigations or workarounds exist for CVE-2026-120225 before patching?
[Mitigation] Restrict access to the management interface immediately and isolate the device from untrusted networks Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-120225
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (oray)
View Category →Oray Pugongying X5 Pro Router Improper Authorization Vulnerability (CVE-2026-120224)
[Affected Scope] Oray Pugongying X5 Pro router versions up to and including 7.6.1
Ubiquiti UniFi OS Path Traversal and Remote Code Execution Vulnerability (CVE-2026-34909)
[Affected Scope] All Ubiquiti UniFi OS devices accessible via the network.
Cisco Secure Email Gateway AMP Arbitrary File Write and Root RCE Vulnerability (CVE-2026-76519)
[Affected Scope] All versions of Cisco Secure Email Gateway with Advanced Malware Protection (AMP) and File Reputation service enabled.
Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286) - Unauthenticated Arbitrary File Write
[Affected Scope] FortiMail versions 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9, and all 7.0 versions.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.