CVE-2026-116235 is a remotely triggerable CRLF injection flaw in the L2TP Authentication component of Oray Pugongying X5 Pro 7.6.1; a public exploit exists and the vendor has not responded to the disclosure.
What Is It
Per the VulDB-assigned NVD record, the flaw sits in an unspecified function of the L2TP Authentication component of Oray Pugongying X5 Pro 7.6.1. An attacker can manipulate the Username argument to cause CRLF injection. The record maps it to CWE-74 (Injection) and CWE-93 (CRLF Injection).
The attack can be launched remotely. NVD says "the exploit has been published and may be used." The CVSS 4.0 vector marks exploit maturity as Proof-of-Concept. One referenced write-up is titled "Oray Pgyer X5 Pro Router 7.6.1 Root Code Execution via L2TP Username Injection." That title says the injection can lead to root-level code execution. The NVD description itself only says CRLF injection.
Why It Matters
- CVSS 3.1: 9.1 CRITICAL (
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 8.5 HIGH, with high impact on both the vulnerable system and subsequent systems
- CVSS 2.0: 8.3 HIGH
The attack is network-based, low-complexity and needs no user interaction. The scope is marked Changed, so a successful attack could reach beyond the vulnerable component. The main limit is that the vectors require high privileges.
A public exploit and a vendor that did not respond to disclosure leave affected devices exposed until a fix exists.
KEV status: CISA KEV has no entry for this CVE. The supplied data does not confirm active exploitation in the wild.
What's Vulnerable
- Vendor: Oray
- Product: Pugongying X5 Pro (the referenced write-up calls it "Pgyer X5 Pro Router")
- Affected version: 7.6.1
- Component: L2TP Authentication
- CPE:
cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*
The record does not list any other affected versions.
Patch Status
The supplied data mentions no patch, fixed version or vendor advisory. According to the disclosure, Oray "was contacted early about this disclosure but did not respond in any way." CISA has not set a required action because the CVE is not in KEV. NVD published the record on 2026-10-26 with status Deferred.
Anyone running Pugongying X5 Pro 7.6.1 should treat the device as unpatched and watch the sources below for vendor updates.