Session ID handler vulnerability in Oray Pugongying X5 Pro

CVE-2026-120223

What is CVE-2026-120223?

A vulnerability has been found in the Oray Pugongying X5 Pro that affects its session ID handling mechanism. Specifically, the issue exists in the 'session_get' function within the 'session.lua' file of the Session ID Handler component. The flaw arises from the manipulation of the '_user' argument, resulting in insufficient randomness of the generated session IDs. This could allow remote attackers to predict session IDs and potentially hijack user sessions. The complexity of exploiting this vulnerability is considered high, posing a significant risk if successfully executed. As this exploit is publicly available, users of the affected versions should take immediate action to secure their devices. Despite attempts to inform the vendor about this issue, there has been no response.

References