Live › vulnerability › CVE-2026-120224
Oray Pugongying (PgyBox) X5 Pro router firmware 7.6.0 and 7.6.1 checks a restricted management account only against the outer run_apis_by_json request. It does not apply the account's API allowlist to the API named inside the JSON payload, and that nested API runs as admin. The researcher showed an account allowed only run_apis_by_json triggering the reset API, which wipes the configuration and reboots the router. A public PoC exists. The vendor did not respond to disclosure and no fix is published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 11:49 UTC. All times on this page are UTC.
Anyone running Oray Pugongying/PgyBox X5 Pro router firmware 7.6.0 or 7.6.1 is affected. The attacker needs a login to a non-admin management account whose allowlist includes run_apis_by_json (the researcher's PoC creates one with the admin password), so the main risk is a delegated or low-privilege account, or a stolen one, reaching admin-only functions. If the management interface is not reachable from untrusted networks and you have no restricted accounts, exposure is much lower.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Pugongying X5 Pro | vendor | 7.6.0, 7.6.1 | – |
7.6.0 and 7.6.1 are listed as affectedUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-120224")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.