Oray Pugongying X5 Pro: CRLF injection in Ser2net service
Summary
A CRLF injection flaw (CWE-93, CWE-74) exists in the Ser2net component of the Oray Pugongying X5 Pro router, firmware 7.6.1. Manipulating the regmsg argument can inject CRLF sequences, which may allow an attacker to alter data or overwrite files on the device. Public reports describe the flaw as reachable remotely, but the required privileges are disputed, so the CVSS vector assumes low privileges. A public proof-of-concept is listed, and the vendor did not respond to early disclosure.
Affected
- Oray Pugongying X5 Pro, firmware 7.6.1 (per CNA data)
- Other firmware versions: Unknown.
Fixed in
Unknown. No vendor advisory or firmware fix was found.
Workaround
- Restrict access to the Ser2net service to trusted hosts only.
- Block WAN access to the management and Ser2net ports.
- Enable authentication in the Ser2net configuration, if the device supports it.
- Where upgrading is impossible, an IPS or WAF with CRLF detection may add a layer of defence.
Exploitation
- Public exploit: VulDB lists the status as proof-of-concept with public access. This has not been verified.
- Not marked as known exploited in the sources reviewed. CISA KEV listing: Not confirmed.
- EPSS: below 1%.
Our recommendation
- Inventory all X5 Pro devices and check their firmware version.
- Block all WAN access to the device's management and Ser2net ports, and limit LAN access to named hosts.
- Check with the vendor for a fix. Since the vendor has not responded, plan to replace the device.
- Monitor the VulDB entry and the Notion write-up for updates and a possible KEV listing.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE-2026-116231 vuldb.com
- VulDB vulnerability 426280 vuldb.com
- VulDB submission 1005078 vuldb.com
- OpenCVE CVE-2026-116231 app.opencve.io
- Vulners CVE-2026-116231 vulners.com
- Notion write-up (third party) app.notion.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:07.
Original description (NVD)
A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.