A critical improper authorization flaw in Oray Pugongying X5 Pro (up to 7.6.1) lets a remote attacker with low privileges call restricted API functions. A public exploit exists. According to VulDB, the vendor did not respond to disclosure.
What Is It
CVE-2026-120224 affects the run_apis_by_json and run_async_task functions in the API Authorization component of Oray Pugongying X5 Pro. The authorization checks on these functions are broken, so a low-privileged user can reach functions they should not be able to call. The CNA (VulDB) maps it to CWE-266 (Incorrect Privilege Assignment) and CWE-285 (Improper Authorization).
The researcher's referenced write-up is titled "Oray Pgyer X5 Pro Router 7.6.1 Restricted Account Can Invoke Factory Reset through the JSON Batch API." That title suggests a restricted account can trigger a factory reset of the device through the batch JSON API.
Why It Matters
- CVSS 3.1: 9.9 (Critical). Vector:
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. It is network-reachable, low complexity, needs only low privileges, needs no user interaction, and the scope is changed. - CVSS 4.0: 8.6 (High). Exploit maturity is rated Proof-of-Concept.
- CVSS 2.0: 9.0.
- A public exploit exists. According to the CNA, "the exploit has been released to the public and may be used for attacks."
- No vendor response has been reported. VulDB says it contacted the vendor before disclosure and got no reply. Oray has not published any statement of its own in the supplied sources.
KEV status: CVE-2026-120224 is not listed in CISA's Known Exploited Vulnerabilities catalog. CISA has not confirmed active exploitation in the wild.
What's Vulnerable
- Vendor: Oray
- Product: Pugongying X5 Pro (the reference write-up calls it "Pgyer X5 Pro Router")
- Component: API Authorization (
run_apis_by_json/run_async_task) - Affected versions: up to 7.6.1. The affected versions listed are 7.6.0 and 7.6.1.
- CPE:
cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*
According to the NVD record, the status is "Received" and the publish date is 2026-11-01. NVD has not yet done its own analysis. The severity scores and CWE mappings above come from the CNA (VulDB).
Patch Status
The supplied sources name no patch or fixed version. VulDB reports no answer from the vendor to the disclosure, and there is no CISA KEV entry, so there is no required action or remediation deadline. Until Oray releases a fix, owners of affected devices should:
- limit who holds even low-privileged accounts on the device
- restrict network access to the management API to trusted hosts
Watch the VulDB entry for updates.