On this page (7 sections)
A relative path traversal flaw, tracked as CVE-2026-120225, has been published for the Oray Pugongying X5 Pro in versions up to 7.6.1. According to the NVD record, it can be triggered remotely, a public exploit is available, and the vendor did not respond when contacted about the disclosure.
If you run this device at an office, a shop or a client site, or if you manage networks where it may be deployed, treat it as an exposed and currently unpatched device until the vendor says otherwise. The sources available so far are thin, so this article separates what is confirmed from what is not.
What was reported
The NVD description says the function config_restore_ex, referenced with the file /etc/openwrt_release, mishandles the argument named filename. Manipulating that argument causes relative path traversal. The record states the attack may be initiated remotely and that the exploit has been made available to the public and could be used for attacks.
The record also says the vendor was contacted early about the disclosure but did not respond in any way. One of the listed references is a write-up titled as a configuration restore filename traversal leading to root code execution. We have not independently verified that claim, and the NVD text itself does not describe code execution, so treat that outcome as the researcher's claim rather than a confirmed impact.
Only one independent publisher covers this story so far, and the NVD entry is the only primary source we could use. Details such as the exact authentication requirements, the exact scope of files reachable, and whether attacks are happening are not stated.
What path traversal means here
Path traversal happens when a program builds a file path from user-supplied input without restricting it to an intended folder. By including sequences that step up a directory level, a request can point at files outside the area the developer meant to expose. In a configuration restore function, a filename parameter is a natural place for this mistake, because the feature reads or writes files based on a name the user provides.
The consequence depends on whether the function reads, writes or overwrites files, and with which privileges. On embedded devices, services often run with high privileges, which is why researchers pay close attention to these bugs. For this CVE, the specific outcome is not confirmed by the NVD text beyond the traversal itself.
Who is exposed
- Anyone running an Oray Pugongying X5 Pro on firmware up to and including 7.6.1.
- Devices whose management interface can be reached from the internet, since the record says the attack may be started remotely.
- Agencies and hosting administrators who manage networks for clients and may not have an inventory of the routers on site.
- Anyone relying on the device as the only barrier between internal systems, such as a staging server or an admin panel, and the internet.
The record does not say whether authentication is required. Until that is clarified, assume the management interface should not be reachable from untrusted networks.
How to check your exposure
Start with an inventory. Find out whether you have this model, which firmware version it runs (the device's admin page or label normally shows it), and whether its management interface listens on a public address.
From a machine outside your network, you can check whether common management ports respond on your public IP. This read-only command uses nmap, a widely used port scanner, to list open ports on an address you own. Replace the placeholder with your own public IP and only scan systems you are authorized to test. Any web admin port that shows as open means the interface is reachable from outside.
nmap -Pn -p 80,443,8080,8443 YOUR_PUBLIC_IPAlso review the device's logs, if it keeps any, for unexpected configuration restore requests or unexplained configuration changes.
What to do now
No fix is documented in the research, so the priority is to reduce exposure and watch for the vendor's response.
0 of 8 done
Monitoring after you reduce exposure
Watch for signs that the device was altered: unexpected configuration changes, new administrator accounts, changed DNS settings, or outbound connections you do not recognize. Router DNS changes are a common way to redirect visitors, so confirm your DNS records still point where you expect. Webforta Monitor can alert you to DNS and certificate changes on your domains, which helps catch downstream effects, although it cannot see inside a router.
If you suspect compromise, follow a structured response such as our guide on what to do when a website is hacked, and review how to check whether a website is hacked.
What is still unknown
- Whether the vendor will publish a fixed firmware version.
- Whether the flaw requires authentication.
- Whether attacks are occurring in the wild. The record says a public exploit exists, but does not report exploitation.
- The full impact. A linked write-up claims root code execution, which the NVD text does not confirm.
We will treat this as an evolving story. Check the NVD entry and the VulDB record for updates.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.