CVE-2026-116233
Received Received - Intake

CRLF Injection in Oray Pugongying X5 Pro Dnsmasq

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116233
EUVD
EUVD-2026-109657

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Oray Pugongying X5 Pro 7.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a CRLF injection flaw in Oray Pugongying X5 Pro 7.6.1's Dnsmasq component. It allows attackers to inject carriage return and line feed characters into the rent_time argument, potentially manipulating HTTP headers or logs. The issue arises from improper input validation in an unspecified function.

Impact Analysis

An attacker could remotely exploit this to inject malicious data, leading to session hijacking, cache poisoning, or log manipulation. Systems using the vulnerable Dnsmasq version may experience unauthorized data exposure or service disruption. The high CVSS scores indicate significant confidentiality, integrity, and availability risks.

Compliance Impact

This vulnerability could violate GDPR's integrity and confidentiality requirements by enabling unauthorized data access or modification. For HIPAA, it risks exposing protected health information through log tampering or cache poisoning. Non-compliance may result in legal penalties or data breach notifications.

Mitigation Strategies

Immediately update or patch the Oray Pugongying X5 Pro to the latest version. Disable or restrict access to the Dnsmasq component if not required. Monitor network traffic for unusual DNS queries or CRLF injection attempts. Apply network-level mitigations such as firewalls or IDS/IPS rules to block malicious inputs targeting the rent_time argument.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116233. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart