CVE-2026-116231

Oray Pugongying X5 Pro Ser2net crlf injection

Severity: 9.4CVSSv4.0
Exploitation: None seen No known exploitation
EPSS: 0.44%as of 2026-10-26
Products: 1no fix yet

No known exploitation, and no fixed version published yet.

An attacker can inject CRLF sequences into the ser2net component's regmsg argument on the Oray Pugongying X5 Pro router, remotely, and a public write-up claims this lets a serial banner newline overwrite existing files. Affected is version 7.6.1 of the Pugongying X5 Pro, scored CVSSv4.0 9.4, with exploitation observed as none. No fixed version is published, so restrict management-plane access to trusted networks until the vendor issues a patch.

Synthesised from 3 public sources. Context, not the facts above. Every point is attributed to the publisher that made it.

Severity ratings conflict

hol.org rates the flaw Critical at CVSS 9.4, strix.ai rates it 9.9/10. Both name Oray Pugongying X5 Pro 7.6.1. Treat the higher figure as the planning case, but record that the published ratings do not agree.

Public exploit, no known exploitation

The disclosure states an exploit has been released publicly. hol.org separately states no source marks it as known exploited. Those two statements conflict: an available exploit is not the same as observed attacks, so neither rules out the other.

No fix or mitigation published

vuldb identifies affected build 7.6.1 and gives no fix, mitigation or exploitation detail. The disclosure notes the vendor was contacted early and did not respond. No source names a patched version, so version-based remediation guidance is unavailable.

What to do

No fixed version is published yet. Apply vendor mitigations or isolate the affected products.

Product	Fixed version
Pugongying X5 Pro	none published

Why it matters

Likely to spread

EPSS estimates a 0.44% chance it is exploited in the next 30 days.

Severity

Scores 9.4 out of 10 (CVSSv4.0). That is remote damage without needing an account.

Your move

If you run any of the 1 products above and cannot patch today, assume it will be targeted and restrict access in the meantime.

Exploitation

Status: No known exploitation
EPSS: 0.44% chance of exploitation in 30 days · 37.63% percentile

Analysis

Public sources, summarised. This is context for your decision. The facts above are the ones to act on.

Source	Adds	Summary
hol.org News	Impact	Advisory rates the flaw Critical at CVSS 9.4 and states no current source marks it as known exploited, a severity figure that conflicts with strix.ai's 9.9, plus a useful 'not currently exploited' indicator.
strix.ai News	Impact	Rates CVE-2026-116231 at CVSS 9.9/10 for Oray Pugongying X5 Pro 7.6.1, a higher score than hol.org's 9.4, so a defender must reconcile the conflicting severity ratings.
vuldb.com News	Background	Identifies the affected build as Oray Pugongying X5 Pro firmware 7.6.1, the only source besides strix.ai naming that specific version; no fix, mitigation or exploitation detail is given.
strix.ai News	Repeats others	Page concerns a different CVE (Plague Inc Evolved input validation); the CVE-2026-116231 text appears only as an unrelated sidebar snippet.
strix.ai News	Repeats others	Page concerns separate injection CVE-2026-116232; the CVE-2026-116231 wording is just an unrelated related-links snippet with no new detail.
strix.ai News	Repeats others	Page concerns an unrelated FFXIV Teamcraft XSS CVE-2026-116229; the CVE-2026-116231 text is only a sidebar snippet adding nothing.

References

Published

2026-10-26 17:50 UTC