Oray Pugongying X5 Pro: CRLF injection in Dnsmasq via DHCP lease time
Summary
The Dnsmasq component of the Oray Pugongying X5 Pro router, firmware 7.6.1, does not properly neutralise the rent_time argument, which enables CRLF injection. An attacker who holds the management password can add dnsmasq directives, for example to alter DNS answers for chosen names. A public proof of concept exists, and the vendor did not respond to early disclosure.
Affected
- Oray Pugongying X5 Pro (also listed as PgyBox X5 Pro Router), firmware 7.6.1
- Earlier firmware versions: unknown, possibly affected but not confirmed
Fixed in
Unknown. No fixed firmware version is known.
Workaround
- Remove internet exposure of the router's web and management interface and restrict it to trusted LAN addresses
- Change the management password to a unique, strong password
- Check DHCP and DNS settings for unexpected entries, such as unknown address overrides
- A WAF or IPS may offer limited detection, but it is a weak control for this device
Exploitation
- Public exploit: yes. VulDB reports technical details and a public exploit; the Notion advisory includes a proof of concept.
- In the wild: not known to be exploited according to OffSeq; OffSeq's honeypot wording is ambiguous.
- CISA KEV: no entry found in the research; not checked directly.
Our recommendation
- Inventory all Oray X5 Pro devices and confirm the firmware version
- Remove management access from the internet and restrict it to trusted addresses
- Replace the admin password with a unique, strong one
- Check DNS and DHCP settings for unexpected entries
- Monitor Oray for an update; replace the device if it is internet-facing and no fix appears
- Note that related CVE-2026-116237 allows root script execution by the same password holder and should be ranked higher
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Notion advisory: Dnsmasq directive injection via DHCP lease time app.notion.com
- VulDB: CVE-2026-116233 vuldb.com
- VulDB: vulnerability 426282 vuldb.com
- VulDB: submission 1005081 vuldb.com
- OpenCVE: CVE-2026-116233 app.opencve.io
- OffSeq Radar: CVE-2026-116233 radar.offseq.com
- Strix: CVE-2026-116233 www.strix.ai
- Notion advisory: related CVE-2026-116237 (root script) app.notion.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:10.
Original description (NVD)
A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.