A critical (CVSS 3.1: 9.1) CRLF injection flaw in Oray Pugongying X5 Pro 7.6.1 can be triggered remotely through the IPsec secproto argument. A public exploit is available, and the vendor has not responded.
What Is It
CVE-2026-116234 is a CRLF injection vulnerability in the IPsec Policy Handler component of Oray Pugongying X5 Pro version 7.6.1. The NVD description, supplied by VulDB, says that manipulating the secproto argument causes CRLF injection in an unknown function that handles the file /etc/ipsec.conf. The weakness is classified as CWE-74 (Injection) and CWE-93 (CRLF Injection). The researcher's write-up is titled "Root Code Execution via IPsec secproto Injection." That title is the only source for the root code execution claim, and NVD's description does not confirm it.
Why It Matters
The attack can be launched remotely, and NVD reports that the exploit has been made public. The CVSS 4.0 vector rates exploit maturity as proof of concept. Scores from the CNA:
- CVSS 3.1: 9.1 CRITICAL (
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Scope is changed, with high impact to confidentiality, integrity and availability. - CVSS 4.0: 8.5 HIGH, with high impact to both the vulnerable system and subsequent systems.
- CVSS 2.0: 8.3 HIGH.
Attacks require network access, low complexity, no user interaction and high privileges. The attacker therefore needs administrative-level access first, which limits who can exploit this. Even so, a public exploit combined with a changed-scope critical rating makes this a priority for anyone running the affected device.
The CISA Known Exploited Vulnerabilities (KEV) catalog has no entry for this CVE. KEV does not confirm active exploitation in the wild at this time.
What's Vulnerable
- Vendor: Oray
- Product: Pugongying X5 Pro
- Affected version: 7.6.1
- Component: IPsec Policy Handler (
/etc/ipsec.conf) - CPE:
cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*
The source data does not list any other versions as affected or unaffected.
Patch Status
The supplied data lists no patch or vendor advisory. The disclosure says the vendor was contacted early but did not respond. NVD lists the record's status as "Deferred." The CVE is not in the CISA KEV catalog, so no federal required action or due date applies. Until a fix is available, owners should treat 7.6.1 as unpatched. Exploitation requires high privileges, so restricting who holds administrative access to the IPsec configuration reduces exposure.