CVE-2026-120223 in Pugongying X5 Pro
Summary
by MITRE • 11/01/2026
A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the function session_get of the file session.lua of the component Session ID Handler. The manipulation of the argument _user leads to insufficiently random values. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/01/2026
The Oray Pugongying X5 Pro, a network video recorder device reaching version 7.6.1, contains a critical cryptographic weakness within its Session ID Handler component. Specifically, the vulnerability resides in the session_get function located in the session.lua script file. This flaw is categorized as CWE-330: Use of Insufficiently Random Values, which indicates that the system fails to generate unique and unpredictable identifiers for user sessions. In secure web applications and network devices, session IDs must be generated using a cryptographically strong pseudo-random number generator to prevent attackers from guessing or predicting valid session tokens. The identified flaw suggests that the underlying randomization mechanism is either weak, predictable, or based on insufficient entropy sources, thereby compromising the fundamental security assumption of session uniqueness.
The operational impact of this vulnerability allows for remote attack initiation without requiring prior authentication in certain contexts, although the complexity and exploitability are rated as high to difficult. This rating implies that while an attacker can theoretically target the system over a network connection, they must possess significant technical expertise or specific conditions to successfully execute the attack. The core risk associated with insufficiently random session IDs is session hijacking. An adversary who can predict or brute-force valid session identifiers may impersonate legitimate users, gaining unauthorized access to administrative interfaces and sensitive data stored on the device. This could lead to a complete compromise of the surveillance system's integrity, allowing attackers to view live feeds, manipulate recordings, or disable security alerts without detection.
Despite the availability of public exploits that demonstrate this weakness in action, vendor engagement has yielded no results. The manufacturer was contacted early regarding this disclosure but failed to respond, leaving users with an unpatched vulnerability for an extended period. This lack of remediation support forces system administrators and end-users to rely on compensating controls rather than definitive fixes. Given the public availability of exploit code, automated scanning tools may already be targeting devices running vulnerable versions, increasing the likelihood of opportunistic attacks even if manual exploitation remains complex.
To mitigate this risk in the absence of a vendor patch, organizations should implement strict network segmentation policies to isolate Oray Pugongying X5 Pro devices from untrusted networks and restrict access to management interfaces only through trusted IP addresses or virtual private networks. Additionally, enforcing strong password policies for all user accounts can reduce the impact if session hijacking occurs by limiting lateral movement capabilities. Regular monitoring of authentication logs for anomalous login patterns associated with known exploit signatures is also recommended. From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1078: Valid Accounts, as it facilitates unauthorized access using valid credentials or tokens derived from weak session generation mechanisms. Until an official patch is released by the vendor, continuous vigilance and network-level restrictions remain the primary defense strategies against exploitation of CWE-330 in this specific firmware version.