Pugongying X5 Pro 7.6.1 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/pugongying-x5-pro-7.6.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 26 Oct 2026 09:40:54 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOray Pugongying X5 Pro: Unrestricted file upload in PPPoE WAN Setting (CVE-2026-116236)https://feed.craftedsignal.io/briefs/2026-10-oray-pugongying-upload/Mon, 26 Oct 2026 09:40:54 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-oray-pugongying-upload/A vulnerability in Oray Pugongying X5 Pro 7.6.1 allows for remote unrestricted file uploads via the PPPoE WAN Setting Handler.A vulnerability exists in Oray Pugongying X5 Pro version 7.6.1 within the plugin_init function of the /tmp/upload_files file, used by the PPPoE WAN Setting Handler. Manipulation of the pppd_options argument allows for unrestricted file uploads. The attack can be launched remotely. Public exploits are available, and the vendor has not responded to disclosure attempts.

]]>highadvisory