CVE-2026-120225 | Oray Pugongying X5 Pro up to 7.6.1 /etc/openwrt_release config_restore_ex filename path traversal

October 31, 2026 Yanac

A vulnerability was found in Oray Pugongying X5 Pro up to 7.6.1. It has been rated as very critical. Affected by this vulnerability is the function config_restore_ex of the file /etc/openwrt_release. This manipulation of the argument filename causes relative path traversal.

This vulnerability appears as CVE-2026-120225. The attack may be initiated remotely. In addition, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More