CVE-2026-120223
Received Received - Intake

Insufficient Session ID Randomness in Oray Pugongying X5 Pro

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: VulDB

Description
A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the function session_get of the file session.lua of the component Session ID Handler. The manipulation of the argument _user leads to insufficiently random values. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-120223

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Oray Pugongying X5 Pro 7.6.0
Oray Pugongying X5 Pro 7.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-330 The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
CWE-310 Cryptographic Issues

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in Oray Pugongying X5 Pro up to version 7.6.1. It involves the session_get function in session.lua, where the _user argument manipulation leads to insufficiently random session IDs. This weakness allows attackers to potentially predict or manipulate session tokens remotely.

Detection Guidance

This vulnerability involves insufficiently random session IDs in Oray Pugongying X5 Pro up to 7.6.1. Detection requires checking session ID generation in session.lua for predictability. No specific commands are provided in the CVE details. Review logs for repeated or sequential session IDs and inspect the session.lua file for weak randomness in _user handling.

Impact Analysis

An attacker could exploit this to hijack user sessions by guessing or forcing predictable session IDs. This may lead to unauthorized access to sensitive data or functions, especially if session management is critical for authentication in the device.

Compliance Impact

This vulnerability involves insufficiently random session IDs, which could allow unauthorized access to user sessions. For GDPR, this may impact data confidentiality and integrity requirements under Articles 32 and 5. For HIPAA, it could affect the security of protected health information by enabling session hijacking or unauthorized access.

Mitigation Strategies

Immediately update Oray Pugongying X5 Pro to the latest version beyond 7.6.1 to address the insufficiently random Session ID values. If no update is available, consider discontinuing use of the device or isolating it from critical network segments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120223. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...