Oray Pugongying X5 Pro: CRLF injection in dnsmasq component
Summary
Firmware 7.6.1 of the Oray Pugongying X5 Pro router contains a CRLF injection flaw in an unspecified part of the bundled dnsmasq component. According to a public write-up, an attacker with the management system password can inject a dhcp-script directive and run a script as root when dnsmasq processes a DHCP lease. An exploit has been published, but the vendor did not respond to early disclosure and no fix is known.
Affected
- Oray Pugongying X5 Pro, firmware 7.6.1 (only version listed as affected)
Fixed in
Unknown. No fixed version is known.
Workaround
- Do not expose the management interface to the internet; restrict it to the LAN or an admin VPN.
- Use a unique, strong management password and change it if the device was reachable from untrusted networks.
- Review DNS, DHCP and dnsmasq-related settings for unexpected line breaks or extra directives.
Exploitation
- Public exploit or proof of concept: claimed by VulDB and indexed by Sploitus; not verified.
- Preconditions: management system password required (CVSS Privileges Required: High).
- In the wild: no evidence found; not marked as known exploited in the sources reviewed.
Our recommendation
- Inventory all Oray Pugongying X5 Pro devices and confirm the firmware version.
- Restrict management access to the LAN or an admin VPN and check that no admin interface is reachable from the internet.
- Change the admin password if it is default, reused or shared with third parties such as an MSP.
- Monitor the vendor and VulDB for a firmware fix; plan isolation or replacement if none appears.
- Check the router's configuration for unexpected dnsmasq directives.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE-2026-116237 vuldb.com
- VulDB vulnerability 426286 vuldb.com
- VulDB submission 1005085 vuldb.com
- Research write-up (Notion) app.notion.com
- Strix CVE-2026-116237 www.strix.ai
- HOL Guard CVE-2026-116237 hol.org
- Sploitus CVE-2026-116237 sploitus.com
- Baidu Baike Oray Pugongying X5 Pro baike.baidu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:07.
Original description (NVD)
A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.