CVE-2026-116235

Oray Pugongying X5 Pro L2TP Authentication crlf injection

View on CVE.org
Published Oct 26, 2026 CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Description
A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A vulnerability in the L2TP Authentication component of Oray Pugongying X5 Pro allows an attacker to inject CRLF characters into the Username parameter. This type of value injection (CWE‑74) combined with improper handling of HTTP parameters (CWE‑93) lets the device interpret the forged payload as additional commands, yielding remote code execution and full device compromise.

Affected Systems

Oray Pugongying X5 Pro routers running firmware 7.6.1 are affected. The flaw resides in the L2TP Authentication module of this specific firmware release; other firmware versions or hardware models are not known to be affected.

Risk and Exploitability

The CVSS score of 9.4 indicates critical severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploit code has been published, and the attack can be launched remotely over the L2TP service. An attacker controlling the Username field of a remote authentication request can trigger the injection, leading to arbitrary command execution. Because the vector is remote and the device often exposes L2TP on the WAN side, any network that permits inbound L2TP connections is at risk.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the firmware to the latest version that addresses the L2TP Username injection flaw.
  • If no patch exists, disable the L2TP service or block inbound L2TP traffic with firewall or ACL rules.
  • Restrict L2TP access to trusted internal IP addresses only and enable logging of authentication attempts, then monitor logs for anomalous activity.

Generated by OpenCVE AI on October 26, 2026 at 11:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Oray Pugongying X5 Pro L2TP Authentication crlf injection
First Time appeared Oray
Oray pugongying X5 Pro
Weaknesses CWE-74
CWE-93
CPEs cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*
Vendors & Products Oray
Oray pugongying X5 Pro
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-93

    Improper Neutralization of CRLF Sequences ('CRLF Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 26, 2026, 4:33 PM
Reserved
Oct 25, 2026, 3:20 PM

View source JSON

Updated
Oct 26, 2026, 4:06 PM

JSON

Status
Deferred
Published
Oct 26, 2026, 9:16 AM
Modified
Oct 26, 2026, 5:17 PM

View source JSON

No data.

Updated
Oct 26, 2026, 6:51 PM

JSON