CVE-2026-116236
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A vulnerability was found in Oray Pugongying X5 Pro 7.6.1 in the plugin_init function of /tmp/upload_files within the PPPoE WAN Setting Handler component. Manipulating the pppd_options argument leads to unrestricted upload. The attack can be launched remotely and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker could upload arbitrary files, potentially leading to code execution or device compromise. The vendor's lack of response increases the risk of no fixes.
Recommendation
Restrict access to the management panel and PPPoE interfaces to trusted networks and implement file upload validation. Monitor vendor advisories and apply patches as soon as they become available.
Other vulnerabilities in Oray Pugongying X5 Pro
See all- CVE-2026-120225Critical
In Oray Pugongying X5 Pro up to version 7.6.1, the config_restore_ex function in /etc/openwrt_release is vulnerable to relative path traversal via manipulation of the filename argument. The attack can be launched remotely and a public exploit is available.
- CVE-2026-120224Critical
In Oray Pugongying X5 Pro up to version 7.6.1, the run_apis_by_json/run_async_task functions in the API Authorization component allow improper authorization. The attack can be launched remotely and a public exploit has been released.
- CVE-2026-116235Critical
A flaw was found in Oray Pugongying X5 Pro 7.6.1 in an unknown function of the L2TP Authentication component. Manipulating the Username argument causes CRLF injection. The attack can be launched remotely and a public exploit is available.
- CVE-2026-116234Critical
A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1 in an unknown function of /etc/ipsec.conf within the IPsec Policy Handler component. Manipulating the secproto argument results in CRLF injection. The attack can be launched remotely and the exploit is public.
- CVE-2026-116233Critical
A security vulnerability was detected in Oray Pugongying X5 Pro 7.6.1 in an unknown function of the Dnsmasq component. Manipulating the rent_time argument leads to CRLF injection. The attack can be initiated remotely and the exploit has been publicly disclosed.
- CVE-2026-116232Critical
A weakness was identified in Oray Pugongying X5 Pro 7.6.1 affecting the snmp_set function of the SNMP Handler component. Manipulating the info.community argument can lead to CRLF injection. The attack can be launched remotely and a public exploit is available.
- CVE-2026-116231Critical
A security flaw was discovered in Oray Pugongying X5 Pro 7.6.1 in an unknown function of the Ser2net component. Manipulating the regmsg argument results in CRLF injection. The attack can be initiated remotely and the exploit has been publicly released.
- CVE-2026-120223Low
In Oray Pugongying X5 Pro up to 7.6.1, the session_get function in session.lua (Session ID Handler component) produces insufficiently random values based on the _user argument. The attack can be initiated remotely, though complexity is rated high and exploitation is considered difficult. The exploit is publicly available and the vendor did not respond to the disclosure.
- CVE-2026-116237High
A vulnerability was found in Oray Pugongying X5 Pro 7.6.1 affecting an unknown part of the Dnsmasq component. Data manipulation results in CRLF injection, and remote exploitation is possible. The exploit has been made public, and the vendor did not respond to the disclosure.
Original NVD description (English source)
A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd_options leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS