Oray vulnerabilities
We track 9 vulnerabilities in Oray products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on November 1, 2026.
Latest Oray vulnerabilities
- 9.1 Critical severity
Pugongying X5 Pro: Improper Limitation of a Pathname to a Restricted Directory
A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function config_restore_ex of the file /etc/openwrt_release. This manipulation of the argument filename causes relative path traversal. The attack may b
- 9.9 Critical severity
Pugongying X5 Pro: Incorrect Privilege Assignment
A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The
- 8.4 High severity
Pugongying X5 Pro: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be
- 7.2 High severity
Pugongying X5 Pro: Improper Access Control
A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd_options leads to unrestricted up
- 9.1 Critical severity
Pugongying X5 Pro: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The
- 9.1 Critical severity
Pugongying X5 Pro: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched rem
- 9.1 Critical severity
Pugongying X5 Pro: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has bee
- 9.9 Critical severity
Pugongying X5 Pro: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch the attack remotely.
- 9.9 Critical severity
Pugongying X5 Pro: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initiate the attack remotel