CVE-2026-116237
Received Received - Intake

CRLF Injection in Oray Pugongying X5 Pro Dnsmasq

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116237
EUVD
EUVD-2026-109683

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Oray Pugongying X5 Pro 7.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a CRLF injection flaw in the Dnsmasq component of Oray Pugongying X5 Pro version 7.6.1. An attacker can manipulate input to inject carriage return and line feed characters, potentially altering HTTP headers or responses. The exploit is public and remote attacks are possible.

Impact Analysis

An attacker could use this to inject malicious content, redirect users to phishing sites, or manipulate responses. This may lead to data theft, unauthorized access, or service disruption. The high CVSS scores indicate significant impact on confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage due to unauthorized data exposure.

Mitigation Strategies

Immediately update or patch the Oray Pugongying X5 Pro device to the latest firmware version. If no patch is available, consider isolating the device from the network to prevent exploitation. Monitor network traffic for unusual DNS or HTTP requests that may indicate CRLF injection attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116237. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart