low · CVSS v3 3.1 · CVSS v4 2.3

CVE-2026-120223

A low‑severity flaw in Oray Pugongying X5 Pro (v≤7.6.1) allows remote attackers to manipulate the _user argument in session_get, producing i

Overview

A low‑severity flaw in Oray Pugongying X5 Pro (v≤7.6.1) allows remote attackers to manipulate the _user argument in session_get, producing insufficiently random session IDs. This can lead to session prediction or hijacking. The vulnerability is publicly documented but the vendor has not released a fix.

Description

A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the function session_get of the file session.lua of the component Session ID Handler. The manipulation of the argument _user leads to insufficiently random values. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

The flaw compromises confidentiality, integrity, and availability of user sessions by enabling attackers to predict or forge session identifiers. Defenders should monitor for anomalous session creation patterns and enforce stricter session ID entropy. The risk is primarily to users of the affected firmware who rely on session isolation.

Remediation

Upgrade to Oray Pugongying X5 Pro firmware 7.6.2 or later once vendor releases a patch. Until then, disable remote session_get calls if possible, or enforce a server‑side session ID generator with cryptographic randomness. Apply network segmentation to limit exposure of the device to untrusted networks.

Risk context

Severity is low (CVSS 3.1) and EPSS is not available, indicating a moderate threat level. However, the vulnerability is publicly available and exploitable remotely, so defenders should treat it with caution and prioritize patching when a fix is released.

Affected products

  • Oray Pugongying X5 Pro

Scores

Severity
low
CVSS v2
2.1
CVSS v3
3.1
CVSS v4
2.3
EPSS
—

session-hijacking session-id remote-attack Oray low-severity entropy firmware

← All CVEs

Related CVEs

low

CVE-2026-120310

Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access, so clients whose class-level permissions or object ACLs allow update but not read can see object data. Attackers can update such objects to read atomic operation results (Increment, Add, AddUnique, Remove), Cloud Code trigger-set values, and, for dot notation keys under certain conditions, the whole stored parent field.

View analysis

low

CVE-2026-117680

Improper check for unusual or exceptional conditions in the pattern and patternProperties keywords of the lud jsv library allows an unauthenticated remote attacker to bypass schema validation by exploiting backtracking budget exhaustion. This can lead to acceptance of malicious data that would otherwise be rejected. The vulnerability affects jsv versions 0.1.0 through 0.26.2.

View analysis

low

CVE-2026-117649

This CVE exposes metadata of private issues linked as dependencies to public issues, allowing anonymous or unauthenticated users to view titles, bodies, labels, and attachment names via the API and web page. The flaw occurs when a readable issue references a private issue, bypassing access controls on the linked issue's content. It matters because it leaks sensitive information about private repositories to anyone who can view the public issue.

View analysis

low

CVE-2026-54610

LibreDWG's bit_TV_to_utf8() can write to caller-provided buffer, causing segmentation faults or unintended data modification. The flaw exists in versions before 0.14 and may lead to denial of service or data integrity issues when processing untrusted DWG files.

View analysis