{"id":"CVE-2026-120224","kind":"vulnerability","aliases":["CVE-2026-120224"],"related":[],"title":"Oray Pugongying X5 Pro 7.6.1: a restricted account can run any admin API through run_apis_by_json (factory reset shown)","description":"A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Oray Pugongying (PgyBox) X5 Pro router firmware 7.6.0 and 7.6.1 checks a restricted management account only against the outer run_apis_by_json request. It does not apply the account's API allowlist to the API named inside the JSON payload, and that nested API runs as admin. The researcher showed an account allowed only run_apis_by_json triggering the reset API, which wipes the configuration and reboots the router. A public PoC exists. The vendor did not respond to disclosure and no fix is published.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Pugongying X5 Pro","fixed":[],"affected":"7.6.0, 7.6.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","infrastructure","oray-pugongying","router","x5-pro"],"not_affected_if":["auth-required","no-restricted-accounts","unknown"],"how_to_check":"Check the router firmware version in the admin UI; 7.6.0 and 7.6.1 are listed as affected. Also check the management accounts: any non-admin account whose privilege list includes run_apis_by_json can reach admin APIs. Check whether the management web interface (/cgi-bin/oraybox) is reachable from the internet.","fix":null,"status":"open","published_at":"2026-11-01T11:18:57+00:00","first_seen_at":"2026-11-01T11:49:50+00:00","triaged_at":"2026-11-01T11:50:04+00:00","updated_at":"2026-11-01T11:50:37+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-01T11:50:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oray Pugongying X5 Pro: improper authorization lets remote attackers reach API functions","impact":"high","summary":"Oray Pugongying X5 Pro up to version 7.6.1 has an improper authorization flaw in its API authorization component (run_apis_by_json/run_async_task). A remote attacker can exploit it, and a public exploit has been released.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["oray-pugongying","x5-pro"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthenticated remote attacker gains unauthorized access to API functions","analyst_note":"Confirm the affected product scope, whether authentication is required, and whether a vendor fix or mitigation exists at https://nvd.nist.gov/vuln/detail/CVE-2026-120224.","how_to_check":"- Check the installed Oray Pugongying X5 Pro version against `7.6.1`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Oray Pugongying X5 Pro at version 7.6.1 or earlier are affected, according to the NVD description. The sources do not say which deployment configurations are exposed or whether the product is commonly internet-facing. The vendor did not respond to early disclosure, and no fixed version is stated.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000687,"input_tokens":4151,"output_tokens":544,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the affected product scope, whether authentication is required, and whether a vendor fix or mitigation exists at https://nvd.nist.gov/vuln/detail/CVE-2026-120224.","search":"'-120224':24A,27A '-2026':23A,26A '7.6.0':49B '7.6.1':5A,51B,142C 'account':8A,56B,71B,94B 'admin':12A,89B 'affect':143C 'allow':95B 'allowlist':74B 'api':13A,16A,62B,73B,77B,86B,98B,104B,148C,154C 'appli':69B 'attack':163C,181C 'auth':32B 'auth-requir':31B 'author':155C,161C 'check':52B 'compon':153C 'configur':108B 'contact':185C 'cve':22A,25A 'disclosur':123B,189C 'discov':134C 'earli':186C 'exist':116B 'exploit':169C 'factori':19A 'firmwar':48B 'fix':126B 'flaw':131C 'function':146C 'improp':160C 'infrastructur':34B 'insid':79B 'json':18A,64B,81B,100B 'json/run_async_task':150C 'launch':166C 'manag':55B 'manipul':157C 'may':177C 'name':78B 'nest':85B 'oray':1A,36B,42B,136C 'oray-pugongi':35B 'outer':60B 'payload':82B 'pgybox':44B 'poc':115B 'pro':4A,30A,41B,46B,139C 'public':114B,175C 'publish':128B 'pugongi':2A,37B,43B,137C 'pugongying':28A 'reboot':110B 'releas':172C 'remot':167C 'request':65B 'requir':33B 'research':91B 'reset':20A,103B 'respond':121B,193C 'restrict':7A,54B 'result':158C 'router':38B,47B,112B 'run':10A,15A,61B,87B,97B,147C 'secur':130C 'show':92B 'shown':21A 'trigger':101B 'use':179C 'vendor':118B,183C 'way':196C 'wipe':106B 'x5':3A,29A,40B,45B,138C 'x5-pro':39B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Oray Pugongying/PgyBox X5 Pro router firmware 7.6.0 or 7.6.1 is affected. The attacker needs a login to a non-admin management account whose allowlist includes run_apis_by_json (the researcher's PoC creates one with the admin password), so the main risk is a delegated or low-privilege account, or a stolen one, reaching admin-only functions. If the management interface is not reachable from untrusted networks and you have no restricted accounts, exposure is much lower.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T11:18:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-120224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120224","severity":null,"published_at":"2026-11-01T11:18:57+00:00","modified_at":"2026-11-01T11:18:57+00:00","first_seen_at":"2026-11-01T11:49:50+00:00","fetched_at":"2026-11-01T11:49:50+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120224:1295","url":null,"severity":null,"published_at":"2026-11-01T11:50:37+00:00","modified_at":"2026-11-01T11:50:37+00:00","first_seen_at":"2026-11-01T11:50:37+00:00","fetched_at":"2026-11-01T11:50:37+00:00","note":"Read VulDB entry and researcher (FirmHarness) Notion write-up with PoC; no vendor advisory found, vendor did not respond to disclosure, so nothing verified. Needs an authenticated non-admin account allowed run_apis_by_json; nested _api runs as admin (factory reset demonstrated). Authenticated, so PoC is not pre-auth."}],"documents":[{"id":38630,"url":"https://vuldb.com/vuln/429583","title":"VulDB VDB-429583: Oray Pugongying X5 Pro up to 7.6.1 improper authorization","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":38631,"url":"https://app.notion.com/p/Oray-PgyBox-X5-Pro-Router-7-6-1-Restricted-Account-Can-Invoke-Factory-Reset-through-the-JSON-Batch-A-3eb797159f1580febfd2f0e1ee239352","title":"Oray PgyBox X5 Pro Router 7.6.1: restricted account can invoke factory reset through the JSON batch API (FirmHarness)","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}