Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload
Impact
Oray Pugongying X5 Pro 7.6.1 has an unrestricted upload vulnerability in the PPPoE WAN Setting Handler's plugin_init function, allowing remote manipulation of the pppd_options argument. The vendor has not responded to disclosure.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Oray · VulDB
Pugongying X5 Pro
1 range
Oray · VulDB
Pugongying X5 Pro
Compare with this publisher’s ranges. This does not inspect your installation.
affected
7.6.1
Other versions: unknown
Product identifiers (CPE)
cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*Original source description
A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd_options leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-116236View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.