CVE-2026-120225

Summary

A relative path traversal vulnerability exists in the config_restore_ex function of /etc/openwrt_release in Oray Pugongying X5 Pro devices up to version 7.6.1, allowing an authenticated remote attacker to read arbitrary files by manipulating the filename argument.

Exploitability

Exploitation requires high-privilege access (PR:H) and no user interaction, but the exploit is publicly available, lowering the barrier for skilled attackers.

Blast radius

Successful exploitation could lead to full compromise of confidentiality, integrity, and availability due to the CVSS scope being changed (S:C), potentially enabling lateral movement or persistent access within the device's network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 7.6.2 or later, as the vendor has not responded to the disclosure and no patch is otherwise available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.