{"id":"CVE-2026-120223","kind":"vulnerability","aliases":["CVE-2026-120223"],"related":[],"title":"Oray Pugongying X5 Pro: weak session IDs let remote attackers guess sessions","description":"A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the function session_get of the file session.lua of the component Session ID Handler. The manipulation of the argument _user leads to insufficiently random values. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The session handler in Oray Pugongying X5 Pro up to 7.6.1 generates session values that are not random enough, so they can be predicted. An attacker who predicts a valid session value may be able to take over an existing login session.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","oray-pugongying","session-management"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-01T10:18:37+00:00","first_seen_at":"2026-11-01T10:49:34+00:00","triaged_at":"2026-11-01T10:51:18+00:00","updated_at":"2026-11-01T10:51:18+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-01T10:51:18Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Oray Pugongying X5 Pro: weak session IDs let remote attackers guess sessions","impact":"medium","summary":"The session handler in Oray Pugongying X5 Pro up to 7.6.1 generates session values that are not random enough, so they can be predicted. An attacker who predicts a valid session value may be able to take over an existing login session.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["oray-pugongying","session-management"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"attacker predicts session values and takes over sessions","analyst_note":"Check the NVD entry and any vendor or product page to confirm the affected deployment and whether a fix exists; the vendor did not respond to disclosure.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Oray Pugongying X5 Pro up to version 7.6.1 are exposed through its session handling in session.lua. The sources do not say which deployments expose the session function to the internet or what configuration is needed. The vendor did not respond to disclosure, so no fixed version is stated.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000655,"input_tokens":4177,"output_tokens":474,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-120223':15A,18A '-2026':14A,17A '7.6.1':36B,79C 'abl':60B 'argument':100C 'attack':10A,51B,108C,114C 'avail':132C 'complex':116C 'compon':92C 'contact':140C 'cve':13A,16A 'difficult':127C 'disclosur':144C 'earli':141C 'enough':44B 'exist':65B 'exploit':122C,129C 'file':88C 'function':83C 'generat':37B 'get':85C 'guess':11A 'handler':28B,95C 'high':120C 'id':7A,94C 'identifi':71C 'impact':81C 'infrastructur':19B 'initi':111C 'insuffici':104C 'lead':102C 'let':8A 'login':66B 'manag':25B 'manipul':97C 'may':58B 'might':134C 'oray':1A,21B,30B,73C 'oray-pugongi':20B 'predict':49B,53B 'pro':4A,33B,76C 'public':131C 'pugongi':2A,22B,31B,74C 'random':43B,105C 'rate':118C 'remot':9A,112C 'respond':148C 'said':124C 'session':6A,12A,24B,27B,38B,56B,67B,84C,93C 'session-manag':23B 'session.lua':89C 'take':62B 'use':136C 'user':101C 'valid':55B 'valu':39B,57B,106C 'vendor':138C 'vulner':69C 'way':151C 'weak':5A 'x5':3A,32B,75C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oray Pugongying X5 Pro up to version 7.6.1 are exposed through its session handling in session.lua. The sources do not say which deployments expose the session function to the internet or what configuration is needed. The vendor did not respond to disclosure, so no fixed version is stated.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T10:18:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120223","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120223","severity":null,"published_at":"2026-11-01T10:18:37+00:00","modified_at":"2026-11-01T10:18:37+00:00","first_seen_at":"2026-11-01T10:49:34+00:00","fetched_at":"2026-11-01T10:49:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}