Oray Pugongying X5 Pro: CRLF injection in IPsec policy handler
Summary
A flaw in the IPsec policy handler of the Oray Pugongying X5 Pro router, firmware 7.6.1, allows CRLF injection through the secproto argument in /etc/ipsec.conf. According to the research notes, an authenticated user can inject strongSwan connection options, which may lead to code execution on the device. A public write-up exists, and the vendor did not respond to early disclosure.
Affected
- Oray Pugongying X5 Pro, firmware 7.6.1
- Older firmware versions may also be affected (unverified)
Fixed in
Unknown.
Workaround
Unknown. No vendor mitigation found. If the IPsec VPN function is not required, disabling it reduces exposure.
Exploitation
- The CVE record states that the exploit is public and may be used.
- The CVSS vector requires high privileges (PR:H); the research notes describe an authenticated caller.
- Active exploitation: Unknown.
Our recommendation
- Check whether the device is internet-reachable and whether IPsec VPN is in use.
- Isolate affected devices and restrict access to the management interface until the vendor provides a fix.
- Disable the IPsec VPN function if it is not required.
- Monitor for unusual configuration changes and check Oray's website for a patch.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Public write-up (Notion) app.notion.com
- VulDB CVE record vuldb.com
- VulDB vulnerability 426283 vuldb.com
- Hol.org CVE record hol.org
- OpenCVE CVE record app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:11.
Original description (NVD)
A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.