CVE-2026-120225 Oray CVE debrief

Who should care

Defenders responsible for Oray Pugongying X5 Pro configurations and security should assess exposure and implement compensating controls. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify affected versions, assess exposure, and implement mitigations to prevent exploitation.

Why it matters

A weakness in Oray Pugongying X5 Pro up to 7.6.1 allows for relative path traversal, potentially leading to attacks. Defenders should verify affected versions, assess exposure, and implement compensating controls.

• Verify affected versions and configurations of Oray Pugongying X5 Pro
• Assess exposure to potential attacks
• Implement compensating controls to prevent exploitation

Technical summary

The function config_restore_ex of the file /etc/openwrt_release in Oray Pugongying X5 Pro up to 7.6.1 is affected by a relative path traversal vulnerability. This manipulation of the argument filename allows for potential attacks. The vulnerability can be exploited remotely, and defenders should prioritize verifying the affected versions and configurations of Oray Pugongying X5 Pro, assessing exposure, and implementing compensating controls. The CVE record and NVD vulnerability detail provide information on the weakness in Oray Pugongying X5 Pro up to 7.6.1.

Defensive priority

Defenders should prioritize verifying the affected versions and configurations of Oray Pugongying X5 Pro, assessing exposure, and implementing compensating controls.

Recommended defensive actions

• Verify the affected versions and configurations of Oray Pugongying X5 Pro
• Assess exposure and implement compensating controls
• Monitor for potential attacks
• Review vendor guidance and apply patches
• Conduct vulnerability scanning and asset inventory
• Implement rollback/change windows for remediation
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD vulnerability detail provide information on the weakness in Oray Pugongying X5 Pro up to 7.6.1. However, the vendor did not respond to the disclosure, and the affected versions and configurations require verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.