Oray Pugongying X5 Pro: CRLF injection in SNMP snmp_set
Summary
Firmware 7.6.1 of the Oray Pugongying X5 Pro router contains a flaw in the snmp_set function of its SNMP handler. A newline in the community string can be used to inject commands into the SNMP daemon configuration, which may then run as root. Per the public research, an attacker needs valid management access to the device, and a public proof-of-concept exists. The vendor did not respond to the disclosure.
Affected
- Oray Pugongying X5 Pro (also written PgyBox X5 Pro or Pgyer X5 Pro), firmware 7.6.1
- Other firmware or hardware versions: Unknown.
Fixed in
- Unknown. No vendor advisory or firmware fix has been found.
Workaround
- No vendor workaround is known.
- Disable SNMP if it is not required.
- If SNMP is needed, allow UDP/161 only from specific management hosts and never expose it on the WAN.
- Restrict the management interface to internal networks and change the admin password.
- Check the SNMP configuration for unexpected lines after changes and review admin logs.
Exploitation
- Public proof-of-concept: yes (third-party research and VulDB).
- Exploited in the wild: no evidence found.
- CISA SSVC: exploitation poc, automatable no, technical impact total.
Our recommendation
- Inventory Oray devices and confirm whether firmware 7.6.1 is in use.
- Check whether SNMP is enabled and disable it, or restrict it to trusted management hosts.
- Change the admin password and limit management access to internal networks.
- Monitor for unexpected SNMP configuration changes and review admin logs.
- If no fix is published by the vendor, plan to replace the device.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Research write-up (Notion) app.notion.com
- VulDB CVE page vuldb.com
- VulDB entry VDB-426281 vuldb.com
- Strix CVE page www.strix.ai
- Threatint CVE page cve.threatint.com
- HOL CVE page hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:08.
Original description (NVD)
A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.