CVE-2026-116235
CriticalCVSS 9.1Summary
A flaw was found in Oray Pugongying X5 Pro 7.6.1 in an unknown function of the L2TP Authentication component. Manipulating the Username argument causes CRLF injection. The attack can be launched remotely and a public exploit is available.
Risk Assessment
A remote attacker could inject headers or data, potentially bypassing authentication or poisoning responses. The vendor did not respond, so a fix may not be available.
Recommendation
Restrict access to management interfaces and L2TP services to trusted networks and deploy WAF/CRLF filtering rules. Monitor vendor advisories and apply patches as soon as they become available.
Other vulnerabilities in Oray Pugongying X5 Pro
See all- CVE-2026-116236High
A vulnerability was found in Oray Pugongying X5 Pro 7.6.1 in the plugin_init function of /tmp/upload_files within the PPPoE WAN Setting Handler component. Manipulating the pppd_options argument leads to unrestricted upload. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-116234Critical
A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1 in an unknown function of /etc/ipsec.conf within the IPsec Policy Handler component. Manipulating the secproto argument results in CRLF injection. The attack can be launched remotely and the exploit is public.
- CVE-2026-116233Critical
A security vulnerability was detected in Oray Pugongying X5 Pro 7.6.1 in an unknown function of the Dnsmasq component. Manipulating the rent_time argument leads to CRLF injection. The attack can be initiated remotely and the exploit has been publicly disclosed.
- CVE-2026-116232Critical
A weakness was identified in Oray Pugongying X5 Pro 7.6.1 affecting the snmp_set function of the SNMP Handler component. Manipulating the info.community argument can lead to CRLF injection. The attack can be launched remotely and a public exploit is available.
- CVE-2026-116231Critical
A security flaw was discovered in Oray Pugongying X5 Pro 7.6.1 in an unknown function of the Ser2net component. Manipulating the regmsg argument results in CRLF injection. The attack can be initiated remotely and the exploit has been publicly released.
Original NVD description (English source)
A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS