CVE-2026-116235: Oray Pugongying X5 Pro L2TP Authentication crlf injection

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-26 · updated 2026-10-26
Weakness: CWE-74

Description

A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Summary

A CRLF injection flaw exists in the L2TP Authentication component of Oray Pugongying X5 Pro 7.6.1, triggered by manipulating the Username argument. It can be attacked remotely and has a critical CVSS score of 9.1. A public proof-of-concept exploit has been published and may be used, though the flaw is not in CISA KEV and EPSS estimates a 0.6% chance of exploitation in 30 days. The vendor did not respond to disclosure; affected users should apply any available firmware update or restrict remote L2TP exposure until a fix is confirmed.

توجد ثغرة حقن CRLF في مكوّن L2TP Authentication في Oray Pugongying X5 Pro 7.6.1، تُستثار عبر التلاعب بالوسيط Username. يمكن استغلالها عن بُعد وحصلت على درجة CVSS حرجة تبلغ 9.1. نُشر استغلال إثبات مفهوم علني وقد يُستخدم، رغم أن الثغرة ليست ضمن CISA KEV وتقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 0.6%. لم يستجب المورّد للكشف؛ على المستخدمين المتأثرين تطبيق أي تحديث للبرنامج الثابت إن توفّر أو تقييد تعرّض L2TP عن بُعد حتى تأكيد الإصلاح.

Affected products

Oray Pugongying X5 Pro: 7.6.1

References

Get alerted when CVE-2026-116235 or the next vulnerability affects your stack