CVE-2026-120223Low· 3.1▾ TwilightPoC availableA vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the function session_get of the file session.lua of the component Session ID Handler. The manipulation of the argument _user leads to insufficiently rando…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 17.1 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the function session_get of the file session.lua of the component Session ID Handler. The manipulation of the argument _user leads to insufficiently random values. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
pugongying_x5_pro 7.6.0pugongying_x5_pro 7.6.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120225Critical· 9.1Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal
CVE-2026-120224Critical· 9.9Oray Pugongying X5 Pro API Authorization run_async_task improper authorization
CVE-2026-116237High· 8.4Oray Pugongying X5 Pro Dnsmasq crlf injection
CVE-2026-116233Critical· 9.1Oray Pugongying X5 Pro Dnsmasq crlf injection
CVE-2026-116234Critical· 9.1Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection
CVE-2026-116235Critical· 9.1Oray Pugongying X5 Pro L2TP Authentication crlf injection