CVE-2026-120225 in Pugongying X5 Pro
Summary
by MITRE • 11/01/2026
A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function config_restore_ex of the file /etc/openwrt_release. This manipulation of the argument filename causes relative path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/01/2026
The vulnerability identified within Oray Pugongying X5 Pro devices, specifically affecting versions up to 7.6.1, represents a critical security flaw rooted in improper input validation and path normalization logic. The core of the issue resides in the config_restore_ex function located within the /etc/openwrt_release file or associated configuration handling mechanisms. This component is responsible for restoring device configurations from provided files, a common operation in Internet of Things devices that allows users to backup and restore settings. However, the implementation fails to adequately sanitize or validate the filename argument passed to this function. Specifically, it does not properly resolve relative path components such as dot-dot sequences (..), leading to a classic directory traversal vulnerability. This flaw enables an attacker to manipulate file paths beyond their intended scope, effectively breaking out of the restricted configuration directory and accessing arbitrary files on the device's filesystem.
From a technical perspective, this is categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The absence of strict path canonicalization allows an attacker to construct malicious input strings that traverse up the directory hierarchy using relative paths. When combined with the fact that the exploit has been publicly disclosed and made available for use, the risk level escalates significantly. Attackers can leverage this weakness to read sensitive system files, such as configuration backups containing plaintext passwords or API keys, or potentially write to critical system locations if write permissions are misconfigured in conjunction with other vulnerabilities. The remote nature of the attack vector means that no physical access is required; an adversary only needs network connectivity to the device's management interface or exposed services to initiate the exploitation attempt.
The operational impact of this vulnerability extends beyond simple information disclosure. By gaining unauthorized read access to sensitive files, attackers can extract credentials, network topology details, and other proprietary configuration data. In more severe scenarios where write operations are possible due to additional privilege escalation flaws often found in such embedded systems, an attacker could overwrite critical system binaries or configuration files, leading to device compromise, persistence mechanisms, or denial of service conditions. The lack of vendor response since early contact suggests that users may not receive timely patches through official channels, leaving the installed base exposed for an extended period. This situation highlights a common challenge in the IoT ecosystem where security updates are often delayed or non-existent after initial deployment.
Mitigation strategies must focus on both immediate defensive measures and long-term remediation. Since vendor patching has been unresponsive, administrators should prioritize network-level controls to restrict access to the device's management interfaces. Implementing strict firewall rules that limit connectivity to trusted IP addresses can significantly reduce the attack surface for remote exploitation. Additionally, if the vulnerable function is exposed via a web interface or API, disabling unnecessary services and ensuring that only authenticated users with appropriate privileges can trigger configuration restoration operations are critical steps. For organizations managing fleets of these devices, segmenting them into isolated network zones prevents lateral movement should one device be compromised. Ultimately, replacing affected hardware with models from vendors who adhere to secure development lifecycles and provide timely security updates remains the most effective long-term solution. This incident underscores the importance of verifying vendor responsiveness during procurement decisions for critical infrastructure components.