CVE-2026-120225 is a critical (CVSS 3.1: 9.1) relative path traversal in Oray Pugongying X5 Pro through version 7.6.1. It can be triggered remotely, a public exploit exists, and the vendor did not respond to the disclosure.
What Is It
The flaw is in the config_restore_ex function, which the record ties to the file /etc/openwrt_release. An attacker can manipulate the filename argument to cause relative path traversal (CWE-22 / CWE-23). VulDB is the CNA, and NVD lists the record as "Received" as of 2026-11-01.
The researcher's write-up is titled "Configuration Restore Filename Traversal Leads to Root Code Execution." That title describes the possible impact, but the NVD description itself only confirms path traversal.
Why It Matters
- Remote attack vector: NVD says "the attack may be initiated remotely" (AV:N, AC:L).
- Public exploit: The exploit has been released publicly and could be used for attacks. CVSS 4.0 rates exploit maturity as Proof-of-Concept.
- Severe impact: Confidentiality, integrity and availability impacts are all High, and the CVSS 3.1 scope is Changed, so the impact can reach beyond the vulnerable component.
- Mitigating factor: The attacker needs high privileges (PR:H), meaning administrative access to the device is required first.
- KEV status: As of 2026-11-01, CVE-2026-120225 is not listed in the CISA Known Exploited Vulnerabilities catalog. KEV does not confirm active exploitation of this CVE at this time.
Scores:
- CVSS 3.1: 9.1 (Critical), CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- CVSS 4.0: 8.5 (High)
- CVSS 2.0: 8.3 (High)
What's Vulnerable
- Vendor: Oray
- Product: Pugongying X5 Pro
- Affected versions: up to 7.6.1. Versions 7.6.0 and 7.6.1 are explicitly listed as affected.
- CPE:
cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*
Patch Status
No patch or fixed version appears in the supplied data. VulDB states the vendor was contacted early about the disclosure "but did not respond in any way." The CVE is not in the CISA KEV catalog as of 2026-11-01, so CISA has set no federal remediation deadline or required action. Those apply only to KEV-listed vulnerabilities under BOD 22-01.
Without a fix, defenders running affected units should: - limit who can reach the device's management interface; - tightly control administrative credentials, since exploitation requires high privileges; - watch the VulDB entries for vendor updates.
Sources
- NVD: CVE-2026-120225
- CISA Known Exploited Vulnerabilities Catalog
- CISA BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities
- VulDB: CVE-2026-120225
- VulDB: Vulnerability 429584
- VulDB: CTI for 429584
- VulDB submission 1007547
- VulDB submission 1007550
- VulDB submission 1007551
- Researcher write-up (Notion): Oray Pgyer X5 Pro Router 7.6.1 Configuration Restore Filename Traversal