The flaw is located in the session_get function of session.lua in the Session ID Handler component of Oray Pugongying X5 Pro routers. Manipulating the _user argument causes the session identifier to be generated with insufficient randomness. A remote actor can exploit this to predict session IDs, enabling the attacker to capture an ordinary user's password. The attack requires high effort and complexity and can be performed remotely, as the code responsible is exposed over the network.

Oray Pugongying X5 Pro routers running firmware versions up to and including 7.6.1 are affected. The vulnerability is tied to the Session ID Handler component of the router's web interface.

The CVSS score of 2.3 indicates a low severity assessment, but the vulnerability still permits confidential data exposure. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The attack can be initiated from a remote location; however, the complexity is high and the exploit is publicly available, meaning that a skilled adversary could attempt it. While the probability of exploitation is not quantified, the potential impact on confidentiality follows from the predictable session ID leading to password disclosure.