A remotely exploitable CRLF injection flaw in the SNMP Handler of Oray Pugongying X5 Pro 7.6.1 has a CVSS 3.1 score of 9.9 (Critical), a public exploit, and no vendor response.
What Is It
CVE-2026-116232 is in the snmp_set function of the SNMP Handler component in Oray Pugongying X5 Pro 7.6.1. An attacker can manipulate the info.community argument to inject carriage-return/line-feed (CRLF) characters. NVD classifies the weakness as CWE-74 (Injection) and CWE-93 (CRLF Injection).
The researcher's write-up, linked in the NVD references, is titled "Oray Pgyer X5 Pro Router 7.6.1: A Community Newline Makes snmpd Run Commands as Root." That title describes the impact as root-level command execution through the SNMP daemon. The NVD description itself only says the flaw leads to CRLF injection.
Why It Matters
- Remote attack: The flaw can be exploited over the network with low attack complexity and no user interaction. The attacker needs low-level privileges.
- Severe impact: The CVSS 3.1 vector (
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) rates confidentiality, integrity and availability impact as High, with a changed scope. VulDB's CVSS 4.0 assessment is 8.6 (High) and rates impact on subsequent systems as High as well. - Public exploit: According to the NVD description, the exploit has been published and could be used in attacks. The CVSS 4.0 exploit maturity is Proof-of-Concept.
- KEV status: The supplied CISA KEV entry is empty. CISA has not confirmed active exploitation, and there is no KEV-mandated remediation deadline.
What's Vulnerable
- Vendor: Oray
- Product: Pugongying X5 Pro
- Affected version: 7.6.1
- Component: SNMP Handler (
snmp_set) - CPE:
cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*
The record does not list any other versions as affected or confirm any as unaffected.
Patch Status
There is no known patch. According to the disclosure, the vendor was contacted early and did not respond. NVD lists the record as "Deferred," and neither CISA nor NVD provides a required action.
Until Oray releases a fix, administrators running version 7.6.1 should check whether SNMP is exposed on these devices. They should also follow the VulDB and researcher references below for updates.