Technical impact
A flaw in the SNMP handler of the Oray Pugongying X5 Pro allows a malicious attacker to inject carriage return and line feed characters into the SNMP community string parameter. This CRLF injection can cause the inferior snmpd daemon to interpret the injected characters as command delimiters, thereby executing arbitrary shell commands supplied by the attacker. The weakness is classified as CWE‑74 (Improper Neutralization of Input) and CWE‑93 (Improper Handling of HTTP Parameters), which together provide a precise path from malformed input to code execution. As the execution of injected commands runs with the privileges of the snmpd service, the attacker can gain full control over the device, modify configuration, exfiltrate data, or use the device as a pivot for further attacks.
Affected Systems
Oray Pugongying X5 Pro routers running firmware version 7.6.1 are vulnerable when the SNMP service is enabled. No other firmware releases or OEMs are known to be affected according to the vendor and community reports.
Risk and Exploitability
The CVSS score of 9.4 marks this as critical. The exploit is publicly available, indicating a low effort to subvert the device. The lack of an EPSS value only indicates that no exploitable traffic volume has been measured so far, but the CVSS score itself shows a very high likelihood of successful exploitation when the attack surface is reachable. The vulnerability is not listed in the CISA KEV catalog, but the combination of a remote entry point and the ability to execute arbitrary commands warrants immediate action. The likely attack vector is remote network access via the SNMP service, where an attacker sends a malicious set request with a crafted community string.
