What happened
A vulnerability designated CVE-2026-116236 has been identified in the Oray Pugongying X5 Pro device running version 7.6.1. The flaw resides within the plugin_init function of the file /tmp/upload_files in the PPPoE WAN Setting Handler component. Exploitation involves manipulation of the pppd_options argument, leading to an unrestricted upload capability. This has been confirmed to be actively exploited in the wild. The exploit allows remote code execution without user interaction, requiring high privileges to be effective. The vulnerability's severity is rated as high, with a CVSS score of 7.2, due to the potential for significant impact on affected systems. As exploitation is possible via a reachable network service without user involvement, the risk presents a serious security concern.
Who is affected
Organisations running the Oray Pugongying X5 Pro device with firmware version 7.6.1 are affected by this vulnerability. These deployments are susceptible to remote exploitation where the network service hosting the flawed component is accessible from the internet or an external network. The vulnerability requires an attacker with high privileges to carry out the exploit, but does not rely on user interaction. The status of specific patches or mitigations from the vendor remains unavailable, and the vulnerability is under active exploitation.
Recommended actions
- Review network segmentation and access control measures to limit exposure of the impacted service to trusted networks or internal segments.
- Implement intrusion detection and prevention systems capable of identifying exploit activity targeting the affected service.
- Monitor for signs of exploitation or anomalous activity associated with the vulnerability, particularly in network traffic directed at the affected device.
