CVE-2026-116233: Oray Pugongying X5 Pro Dnsmasq crlf injection

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-26 · updated 2026-10-31
Weakness: CWE-74

Description

A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Summary

A CRLF injection flaw in the Dnsmasq component of Oray Pugongying X5 Pro 7.6.1 allows manipulation of the rent_time argument, enabling remote attacks. With a critical CVSS score of 9.1, this could let attackers inject malicious content or manipulate responses. A public exploit exists and may be used, though the vendor has not responded. Affected users should apply mitigations such as restricting network exposure and monitoring for vendor updates, as no patch is confirmed.

توجد ثغرة حقن CRLF في مكوّن Dnsmasq ضمن Oray Pugongying X5 Pro 7.6.1، تسمح بالتلاعب بالوسيط rent_time وتنفيذ هجمات عن بُعد. وبدرجة خطورة 9.1 (حرجة)، قد تمكّن المهاجمين من حقن محتوى ضار أو التلاعب بالاستجابات. هناك استغلال عام متاح وقد يُستخدم، بينما لم تستجب الجهة المصنّعة. على المستخدمين المتأثرين تطبيق تدابير تخفيف مثل تقييد التعرض للشبكة ومراقبة تحديثات المصنّع، إذ لم يُؤكَّد إصدار تصحيحي.

Affected products

Oray Pugongying X5 Pro: 7.6.1

References

Get alerted when CVE-2026-116233 or the next vulnerability affects your stack