Oray Pugongying X5 Pro: Unrestricted file upload in PPPoE WAN Setting (CVE-2026-116236)
A vulnerability in Oray Pugongying X5 Pro 7.6.1 allows for remote unrestricted file uploads via the PPPoE WAN Setting Handler.
CVE search metadata
CVE search record: CVE-2026-116236. Severity: high. CVSS: 7.2. KEV: no. Product: Pugongying X5 Pro 7.6.1. Brief: Oray Pugongying X5 Pro: Unrestricted file upload in PPPoE WAN Setting (CVE-2026-116236). Brief link: https://feed.craftedsignal.io/briefs/2026-10-oray-pugongying-upload/
Triage facts
Revision 1- Applicability
- Pugongying X5 Pro 7.6.1
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 26, 09:40 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability exists in Oray Pugongying X5 Pro version 7.6.1 within the plugin_init function of the /tmp/upload_files file, used by the PPPoE WAN Setting Handler. Manipulation of the pppd_options argument allows for unrestricted file uploads. The attack can be launched remotely. Public exploits are available, and the vendor has not responded to disclosure attempts.