CVE-2026-116236 | Oray Pugongying X5 Pro 7.6.1 PPPoE WAN Setting /tmp/upload_files plugin_init pppd_options unrestricted upload

October 25, 2026 Yanac

A vulnerability described as critical has been identified in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd_options leads to unrestricted upload.

This vulnerability is traded as CVE-2026-116236. The attack may be launched remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More