CVE-2026-116236

Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload

View on CVE.org
Published Oct 26, 2026 CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Description
A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd_options leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

Based on the description, it is inferred that the vulnerability resides in the PPPoE WAN Setting Handler on Oray Pugongying X5 Pro 7.6.1. During plugin initialization, a user‑controlled argument named pppd_options is accepted and used to write files to the /tmp/upload_files directory without proper validation. This unrestricted upload allows an attacker to place arbitrary files on the router, potentially leading to remote code execution if the uploaded content is executed. The weakness corresponds to CWE‑284 (Improper Access Control) and CWE‑434 (Unrestricted Upload of File with Dangerous Type).

Affected Systems

Oray Pugongying X5 Pro, firmware version 7.6.1. No other product or version information is available.

Risk and Exploitability

Based on the description, it is inferred that the CVSS score of 8.6 indicates medium‑to‑high severity. EPSS data is not available, but the vulnerability has been publicly disclosed and can be exploited remotely via the PPPoE WAN Setting interface. Because the exploit can be launched from any network connected to the router and does not require local privilege escalation, the probability of exploitation is significant. The vendor has not yet released a patch, and the vulnerability is not listed in CISA’s KEV catalog.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor’s official firmware update once it is available.
  • Disable or remove the PPPoE WAN Setting Handler to eliminate the upload pathway.
  • Restrict access to the router’s administrative interface to trusted networks only by configuring firewall rules or the router’s ACL settings.

Generated by OpenCVE AI on October 26, 2026 at 10:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd_options leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload
First Time appeared Oray
Oray pugongying X5 Pro
Weaknesses CWE-284
CWE-434
CPEs cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*
Vendors & Products Oray
Oray pugongying X5 Pro
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.2, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-434

    Unrestricted Upload of File with Dangerous Type

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 31, 2026, 1:10 AM
Reserved
Oct 25, 2026, 3:20 PM

View source JSON

Updated
Oct 31, 2026, 1:10 AM

JSON

Status
Deferred
Published
Oct 26, 2026, 9:16 AM
Modified
Oct 31, 2026, 1:17 AM

View source JSON

No data.

Updated
Oct 26, 2026, 6:51 PM

JSON