---
id: "CVE-2026-120224"
kind: "vulnerability"
aliases: ["CVE-2026-120224"]
title: "Oray Pugongying X5 Pro 7.6.1: a restricted account can run any admin API through run_apis_by_json (factory reset shown)"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Pugongying X5 Pro", "fixed": [], "affected": "7.6.0, 7.6.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "infrastructure", "oray-pugongying", "router", "x5-pro"]
not_affected_if: ["auth-required", "no-restricted-accounts", "unknown"]
published_at: "2026-11-01T11:18:57+00:00"
first_seen_at: "2026-11-01T11:49:50+00:00"
updated_at: "2026-11-01T11:50:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120224", "first_seen_at": "2026-11-01T11:49:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-01T11:50:37+00:00"}]
---

# Oray Pugongying X5 Pro 7.6.1: a restricted account can run any admin API through run_apis_by_json (factory reset shown)

Oray Pugongying (PgyBox) X5 Pro router firmware 7.6.0 and 7.6.1 checks a restricted management account only against the outer run_apis_by_json request. It does not apply the account's API allowlist to the API named inside the JSON payload, and that nested API runs as admin. The researcher showed an account allowed only run_apis_by_json triggering the reset API, which wipes the configuration and reboots the router. A public PoC exists. The vendor did not respond to disclosure and no fix is published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Pugongying X5 Pro affected 7.6.0, 7.6.1 fixed ?

## How to check

Check the router firmware version in the admin UI; 7.6.0 and 7.6.1 are listed as affected. Also check the management accounts: any non-admin account whose privilege list includes run_apis_by_json can reach admin APIs. Check whether the management web interface (/cgi-bin/oraybox) is reachable from the internet.

## Timeline

- 2026-11-01T11:49:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120224
- 2026-11-01T11:50:37+00:00 analyst — Read VulDB entry and researcher (FirmHarness) Notion write-up with PoC; no vendor advisory found, vendor did not respond to disclosure, so nothing verified. Needs an authenticated non-admin account allowed run_apis_by_json; nested _api runs as admin (factory reset demonstrated). Authenticated, so PoC is not pre-auth.

## Documents

- [describes] VulDB VDB-429583: Oray Pugongying X5 Pro up to 7.6.1 improper authorization https://vuldb.com/vuln/429583
- [poc] Oray PgyBox X5 Pro Router 7.6.1: restricted account can invoke factory reset through the JSON batch API (FirmHarness) https://app.notion.com/p/Oray-PgyBox-X5-Pro-Router-7-6-1-Restricted-Account-Can-Invoke-Factory-Reset-through-the-JSON-Batch-A-3eb797159f1580febfd2f0e1ee239352

## From the sources

A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_