A CRLF injection flaw exists in the Ser2net component of Oray Pugongying X5 Pro 7.6.1. By manipulating the regmsg argument, an attacker can insert carriage‑return and line‑feed characters that the device processes as legitimate input. This can subvert the normal behavior of the service, potentially allowing the injection of malicious commands or manipulation of configuration files. The vulnerability is exploitable from a remote location and public exploits have already been released, indicating that an attacker can gain significant control over the device.

Oray Pugongying X5 Pro routers running firmware 7.6.1 are affected. No other versions are listed as vulnerable in the available data.

The CVSS score of 9.4 marks this as a critical risk. The EPSS score is currently not available, and the vulnerability is not listed in CISA’s KEV catalog, but the existence of a public exploit and the remote attack vector imply a high likelihood of exploitation. Attackers can initiate the flaw from outside the local network, sending crafted requests to the Ser2net service and inducing the CRLF injection.