Oray Pugongying X5 Pro: CRLF injection in L2TP authentication
Summary
The Oray Pugongying X5 Pro router in firmware 7.6.1 contains a CRLF injection flaw in its L2TP authentication component, where the Username argument is not properly sanitised. According to the VulDB submission, an attacker with the management password can add content to a PPP options file, which may lead to code execution with root privileges when the router dials a reachable L2TP server. A public exploit is reported, the vendor did not respond to the disclosure, and no fix is known.
Affected
- Oray Pugongying X5 Pro, firmware 7.6.1
- Other firmware versions or hardware models: unknown
Fixed in
Unknown. No vendor advisory or patch was found.
Workaround
- Disable L2TP if it is not required (unverified, based on a machine-generated summary)
- Restrict access to the administrative interface to trusted networks via firewall rules or ACLs
- Change default administrative credentials
Exploitation
- Public exploit and technical details are known (VulDB, OffSeq: maturity POC)
- Attacker needs the management password according to the VulDB submission
- Not listed in CISA KEV; no confirmed exploitation in the wild
- CVSS score conflict: 8.5 (CVSS 4.0 in the input data), 9.4 (CVSS 4.0 per OffSeq and HOL), 9.1 (CVSS 3.1 per VulDB and others)
Our recommendation
- Identify all X5 Pro units running firmware 7.6.1
- Remove internet exposure of the administrative interface
- Disable L2TP where it is not required, and check outbound L2TP use
- Replace the admin password with a strong unique one
- Plan replacement with a supported model if no vendor fix appears
- Check related CVEs for the same model, such as CVE-2026-116237 and CVE-2026-120225
- Re-check vendor and NVD status regularly
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE-2026-116235 vuldb.com
- VulDB vuln 426284 vuldb.com
- VulDB submission 1005083 vuldb.com
- OffSeq threat radar radar.offseq.com
- HOL Guard CVE-2026-116235 hol.org
- Vulners CVE-2026-116235 vulners.com
- OpenCVE CVE-2026-116235 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:08.
Original description (NVD)
A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.