CVE-2026-116233
Oray Pugongying X5 Pro Dnsmasq crlf injection
Oray Pugongying X5 Pro
CVSS
9.4CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Text from CVE List
Affected versions 1
- Pugongying X5 Proaffected: 7.6.1CVE List
References 5
- vuldb.com/cve/CVE-2026-116233Advisoryvia CVE List
- vuldb.com/submit/1005081Advisoryvia CVE List
- app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Dnsmasq-Directive-Injection-Through-DHCP-Lease-Time-3ea797159f1580979394d23087844670Exploitvia CVE List
- vuldb.com/vuln/426282Referencevia CVE List
- vuldb.com/vuln/426282/ctiReferencevia CVE List