Oray Pugongying X5 Pro 7.6.1 has a remotely exploitable CRLF injection flaw in its Ser2net component, rated CVSS 9.9 Critical. A public exploit exists, and according to VulDB the vendor has not responded.
What Is It
CVE-2026-116231 is a CRLF injection vulnerability in an unspecified function of the Ser2net component in Oray Pugongying X5 Pro version 7.6.1. An attacker triggers it by manipulating the regmsg argument. The CNA (VulDB) maps the weakness to CWE-74 (Injection) and CWE-93 (CRLF Injection).
The researcher's referenced write-up is titled "Oray Pgyer X5 Pro Router 7.6.1: A Serial Banner Newline Lets ser2net Overwrite Existing Files." That title suggests the injected newline can be used to overwrite existing files on the device. The NVD description itself does not confirm that impact.
Why It Matters
- Remote attack: The attack can be started over the network (AV:N) with low complexity and no user interaction.
- Low privileges needed: The attacker needs low-level privileges (PR:L).
- Scope change: The CVSS 3.1 vector (
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) marks scope as changed, with high impact to confidentiality, integrity and availability. That yields a 9.9 Critical score. The CVSS 4.0 score is 8.6 High, with high impact to both the vulnerable system and subsequent systems. - Public exploit: NVD states the exploit has been released to the public and may be used for attacks. CVSS 4.0 rates exploit maturity as Proof-of-Concept.
- No vendor response reported: According to VulDB, Oray was contacted early about the disclosure but did not respond.
This CVE is not in the CISA Known Exploited Vulnerabilities catalog, so KEV does not confirm active in-the-wild exploitation (CISA, Known Exploited Vulnerabilities Catalog). NVD lists the record's status as "Deferred."
What's Vulnerable
- Vendor: Oray
- Product: Pugongying X5 Pro (called "Pgyer X5 Pro Router" in the researcher's write-up)
- Affected version: 7.6.1
- Component: Ser2net
- CPE:
cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*
The supplied data lists no other versions as affected or unaffected.
Patch Status
The supplied data contains no patch, fixed version or vendor advisory. VulDB reports that the vendor did not respond to the disclosure. There is no CISA KEV entry, so no federal remediation deadline or required action applies. The exploit is public and no vendor response has been reported, so owners of version 7.6.1 should restrict network access to these devices and their Ser2net service. They should also watch Oray for a fixed release.