{"id":"CVE-2026-120224","published":"2026-11-01T11:18:57.437","lastModified":"2026-11-01T11:18:57.437","description":"A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-266","CWE-285"],"vendors":[],"products":[],"references":[{"url":"https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Restricted-Account-Can-Invoke-Factory-Reset-through-the-JSON-Batch-AP-3eb797159f1580febfd2f0e1ee239352","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120224","tags":[]},{"url":"https://vuldb.com/submit/1007541","tags":[]},{"url":"https://vuldb.com/submit/1007542","tags":[]},{"url":"https://vuldb.com/vuln/429583","tags":[]},{"url":"https://vuldb.com/vuln/429583/cti","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical improper authorization flaw exists in the API Authorization component of Oray Pugongying X5 Pro up to version 7.6.1, allowing authenticated attackers to bypass intended access controls and perform unauthorized privileged operations remotely via the run_apis_by_json/run_async_task endpoints.","exploitability":"Exploitation requires valid low-privilege credentials (PR:L) and can be performed remotely without user interaction (AV:N, AC:L, UI:N).","blast_radius":"Successful exploitation grants high confidentiality, integrity, and availability impact across the system (C:H/I:H/A:H), potentially enabling full compromise including data exfiltration, unauthorized configuration changes, or service disruption.","remediation":"Upgrade to Oray Pugongying X5 Pro version 7.6.2 or later; if no fixed version is available, immediately disable or restrict access to the run_apis_by_json and run_async_task API endpoints until patched.","detection":"Monitor for anomalous use of the /api/run_apis_by_json or /api/run_async_task endpoints by low-privilege users, especially requests containing elevated or unexpected API parameters not typical for the user's role.","tags":["auth-bypass","api-abuse","remote-exploit","privilege-escalation","web-api"],"model":"garnet-coder","analyzedAt":"2026-11-02T09:47:35.397Z"}}