CVE-2026-120224
Improper Authorization in Oray Pugongying X5 Pro up to 7.6.1
- CVSS 4.0
- 8.6 high
- EPSS
- —
- Published
- ·
- Modified
A flaw in Oray Pugongying X5 Pro up to 7.6.1 in the API Authorization component allows improper authorization through run_apis_by_json and run_async_task functions. Attackers can trigger it remotely without authentication. This may enable unauthorized access or system control. All users of affected versions are at risk.
What to do: Upgrade to version 7.6.1 or later; no workaround provided by vendor.
| Product | Affected |
|---|---|
| Oray Pugongying X5 Pro | up to 7.6.1 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Weakness
- CWE-266, CWE-285
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
0 storiesNo ingested article mentions this CVE yet.