CVE-2026-116233 is a critical-rated (CVSS 3.1: 9.1) CRLF injection flaw in the Dnsmasq component of Oray Pugongying X5 Pro 7.6.1; a public exploit exists, and the vendor did not respond to the disclosure.
What Is It
CVE-2026-116233 is a CRLF injection vulnerability in an unspecified function of the Dnsmasq component in Oray Pugongying X5 Pro version 7.6.1. An attacker can trigger it remotely by manipulating the rent_time argument. The weaknesses are listed as CWE-74 (Injection) and CWE-93 (CRLF Injection). The title of the researcher's public write-up refers to the issue as "Dnsmasq Directive Injection Through DHCP Lease Time."
VulDB, acting as the CNA, published the CVE on 2026-10-26. NVD lists its status as "Deferred."
Why It Matters
- Severity: VulDB scores it CVSS 3.1 9.1 (Critical), vector
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The CVSS 4.0 score is 8.5 (High), and the CVSS 2.0 score is 8.3 (High). - Attack profile: The attack works over the network, has low complexity and needs no user interaction. It does require high privileges, which limits who can trigger it.
- Impact: Confidentiality, integrity and availability impacts are all rated High. The scope is "Changed," which means a successful attack can affect components beyond the vulnerable one.
- Exploit availability: The exploit has been published and may be used. CVSS 4.0 rates exploit maturity as Proof-of-Concept.
- KEV status: This CVE is not in the CISA Known Exploited Vulnerabilities catalog. The supplied data does not confirm any active exploitation in the wild.
What's Vulnerable
| Vendor | Product | Component | Affected Version |
|---|---|---|---|
| Oray | Pugongying X5 Pro | Dnsmasq | 7.6.1 |
CPE: cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*
The source data confirms only version 7.6.1 as affected.
Patch Status
No patch is listed. According to the CVE record, Oray was contacted before disclosure and did not respond. The supplied data contains no vendor advisory, fixed version or official workaround. CISA has not issued a required action, because the CVE is not in KEV.
Owners of Pugongying X5 Pro 7.6.1 devices should check the references below and watch for any vendor update. Because the attack needs high privileges, it also makes sense to review who holds administrative access to affected devices.