CVE-2026-116237

Oray Pugongying X5 Pro Dnsmasq crlf injection

View on CVE.org
Published Oct 26, 2026 CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Description
A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A manipulation of traffic handled by the Dnsmasq component in Oray Pugongying X5 Pro firmware 7.6.1 enables CRLF injection, allowing an attacker to insert unintended CR and LF characters into DNS responses. This flaw is a form of improper input validation (CWE-74) that can lead to external control of system commands (CWE-93). An attacker who can send crafted DNS queries to the router could potentially run arbitrary scripts or commands on the device, compromising its confidentiality, integrity, and availability.

Affected Systems

The vulnerability affects the Oray Pugongying X5 Pro router running firmware version 7.6.1. No other firmware releases or hardware models are referenced in the disclosed information, so the impact is limited to devices operating that specific firmware.

Risk and Exploitability

The CVSS score of 9.3 signals a critical risk. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, but the publicly available exploit demonstrates that remote exploitation can be achieved, likely through crafted DNS requests that inject CRLF sequences into server responses. If an attacker can reach the device over the network, they could execute arbitrary commands, making this a high‐priority vulnerability for exposed routers.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest Oray firmware that resolves the Dnsmasq CRLF injection, as released by the vendor.
  • If an update is not yet available, block or limit inbound DNS traffic to the router with firewall rules or place the device behind an internal VLAN, ensuring it cannot be directly accessed from the Internet.
  • Continuously monitor DNS traffic for occurrences of CRLF sequences and alert on suspicious requests; disable the Dnsmasq service or apply input filtering if the firmware provides those options.

Generated by OpenCVE AI on October 26, 2026 at 10:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Oray Pugongying X5 Pro Dnsmasq crlf injection
First Time appeared Oray
Oray pugongying X5 Pro
Weaknesses CWE-74
CWE-93
CPEs cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*
Vendors & Products Oray
Oray pugongying X5 Pro
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-93

    Improper Neutralization of CRLF Sequences ('CRLF Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Nov 2, 2026, 5:19 PM
Reserved
Oct 25, 2026, 3:20 PM

View source JSON

Updated
Nov 2, 2026, 5:19 PM

JSON

Status
Deferred
Published
Oct 26, 2026, 10:16 AM
Modified
Nov 2, 2026, 6:18 PM

View source JSON

No data.

Updated
Oct 26, 2026, 11:45 AM

JSON