The vulnerability is a CRLF injection flaw in the secproto argument of the /etc/ipsec.conf configuration file on Oray Pugongying X5 Pro routers. By sending an attacker‑controlled string containing carriage‑return and line‑feed characters, a remote user can inject new configuration lines or alter existing ones. If the router processes these changes without proper sanitization, the attacker may be able to execute arbitrary commands or gain elevated privileges on the device. The flaw is not limited to denial of service; the public exploit demonstrates the potential for remote code execution.

Oray Pugongying X5 Pro, firmware version 7.6.1. The only affected product listed in the CVE is this specific router model; no other vendors or product lines are known to be impacted.

The CVSS score of 9.4 indicates a very high severity. The EPSS score is currently not available, so no data on current exploitation frequency. The vulnerability is not listed in the CISA KEV catalog, but the publicly available exploit suggests a realistic attack likelihood. The attack vector is remote; an adversary only needs to send a crafted packet to the router’s IPsec Policy Handler. Official vendor response was delayed or absent, which increases the risk window.