3.1
LowCVSS 3.1 · from VulDB
CVE-2026-120223
Oray Pugongying X5 Pro Session ID session.lua session_get random values
Pugongying X5 Pro · CWE-330 · CWE-330AffectedPugongying X5 Pro
FixNo fix listed yet.
PublishedNov 1, 10:00 · VulDB
ScoredNov 1 · 3.1 · VulDB
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Description
A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the function session_get of the file session.lua of the component Session ID Handler. The manipulation of the argument _user leads to insufficiently random values. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
From VulDB
Affected and fixed versions
ProductAffectedFixed inPugongying X5 Pro7.6.0–Pugongying X5 Pro7.6.1–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known