Description
A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-26
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a CRLF injection in the 'rent_time' argument of Dnsmasq in Oray Pugongying X5 Pro 7.6.1. This flaw allows an attacker to insert newline characters into the DHCP lease configuration, potentially enabling arbitrary configuration directives. The impact could include unauthorized modification of router settings or execution of commands with router privileges, as reflected by the high CVSS score and associated CWE-74 and CWE-93.

Affected Systems

This issue affects the Oray Pugongying X5 Pro router running firmware version 7.6.1. No other affected versions are listed in the CNA data.

Risk and Exploitability

The CVSS score of 9.4 indicates critical severity. Attack can be initiated remotely via a crafted DHCP request containing an injected rent_time value. An exploit has been publicly disclosed, though no patch or KEV listing is available. The absence of an EPSS score does not preclude a real‑world risk, as the vulnerability remains actively exploited in the wild.

Generated by OpenCVE AI on October 26, 2026 at 09:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update router firmware to a version that addresses the rent_time injection issue.
  • If an update is not available, disable or remove the rent_time configuration option in Dnsmasq or set it to a fixed safe value.
  • Configure network firewall rules to block or rate‑limit suspicious DHCP traffic that might contain malicious rent_time values.
  • Continuously monitor the router logs for unexpected configuration changes or CRLF injection patterns.

Generated by OpenCVE AI on October 26, 2026 at 09:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 08:45:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Oray Pugongying X5 Pro Dnsmasq crlf injection
First Time appeared Oray
Oray pugongying X5 Pro
Weaknesses CWE-74
CWE-93
CPEs cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*
Vendors & Products Oray
Oray pugongying X5 Pro
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Oray Pugongying X5 Pro
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-26T08:15:14.847Z

Reserved: 2026-10-25T15:20:20.131Z

Link: CVE-2026-116233

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-26T09:16:34.787

Modified: 2026-10-26T13:41:11.497

Link: CVE-2026-116233

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T18:51:23Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-93

    Improper Neutralization of CRLF Sequences ('CRLF Injection')