On this page (7 sections)
A new CVE record describes an improper authorization flaw in Oray Pugongying X5 Pro, in versions up to 7.6.1. According to the NVD entry, the problem sits in the API Authorization component, can be triggered remotely, and a public exploit has been released. The record also says the vendor was contacted early and did not respond.
If you manage this device at an office, a client site or a hosting location, or if your website's admin access depends on a network behind one, treat it as exposed until you know otherwise. No fixed version is named in the research, so the practical focus is reducing who can reach the device.
What the record says
The NVD description says the affected code is the function run_apis_by_json/run_async_task in the API Authorization component. Manipulating it results in improper authorization, and the attack can be launched remotely. The CVE is listed with CWE-266 and CWE-285, both authorization weaknesses, and was published on 2026-11-01.
The record does not say whether authentication is required, what an attacker gains, or which firmware build contains a fix. One of the references is a third-party write-up on Notion whose title reads "Oray Pgyer X5 Pro Router 7.6.1 Restricted Account Can Invoke Factory Reset through the JSON Batch API". That title suggests a lower-privileged account may be able to trigger actions it should not, including a factory reset. We have not been able to confirm the contents of that page, so treat this as an unverified indication, not an established impact.
What improper authorization means in plain terms
Authentication asks who you are. Authorization asks what you are allowed to do. An improper authorization flaw means a request is accepted even though the account or session making it should not have that permission. On a device that exposes a batch or JSON API, this can let a restricted user run administrative functions.
These flaws are easy to overlook because login works as designed. The gap is in the permission check after login, which is why network-level restrictions on who can reach the management interface are such an effective stopgap.
Who is realistically exposed
- Owners of an Oray Pugongying X5 Pro running 7.6.1 or earlier.
- Teams that give limited or guest accounts on the device to staff, contractors or clients.
- Anyone whose management interface or API is reachable from the internet, since the attack is described as remote.
- Small offices and agencies where this device sits in front of staging servers, admin panels or a CMS.
If you do not own this product, this CVE does not affect you directly. Still, it is a useful prompt to review which network devices have management access open to the internet.
How to check your exposure
Start with an inventory. Confirm whether you have the device, which firmware version it runs, and who can reach its management interface. The version is normally shown in the device's admin page or in your asset records; the research does not give a specific path, so use the vendor's interface or documentation.
- Find every Oray Pugongying X5 Pro you manage, including units at client sites.
- Record the firmware version. Anything at 7.6.1 or earlier is within the affected range in the CVE record.
- List all accounts on the device and note which are restricted or non-admin.
- Check whether the management interface or API is reachable from outside your network, for example from a connection that is not on your LAN or VPN.
- Review device logs, if available, for unexpected configuration changes, reboots or factory resets.
What to do now
Because the vendor has not responded and no fixed version is listed, you cannot rely on a patch yet. Reduce exposure and watch for updates.
0 of 7 done
Monitoring afterward
Watch for signs the device was tampered with: unexpected reboots, settings reverting to defaults, new accounts, or port forwards you did not create. Keep a dated record of the firmware version and configuration so changes stand out.
For the websites behind the network, keep outside monitoring on. Uptime, certificate and DNS monitoring can flag unexpected downtime or DNS changes, and a read-only scan of your verified sites shows what is visible from the internet. These do not detect this device flaw, but they help you notice knock-on effects. If you find signs of compromise, follow our guide on what to do when a website is hacked.
What is still unknown
- Whether the vendor will release a fix, and in which version.
- The exact privileges an attacker needs before exploiting the flaw.
- Whether attacks are happening in the wild. The record says the exploit is public and may be used for attacks, but does not report confirmed exploitation.
- The full impact, since the CVE text does not describe it.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.