CVE-2026-116233
Oray Pugongying X5 Pro Dnsmasq crlf injection
- Severity
- 9.4CVSSv4.0
- Exploitation
- None seen No known exploitation
- EPSS
- 0.46%as of 2026-10-26
- Products
- 1no fix yet
No known exploitation, and no fixed version published yet.
An attacker can inject CRLF characters into Dnsmasq directives by sending a crafted DHCP rent_time value to a remote Oray Pugongying X5 Pro router. The flaw hits Pugongying X5 Pro 7.6.1, no fixed version is published, so block untrusted networks from the router's DHCP and management interfaces. An exploit is public, exploitation is none-observed, CVSSv4.0 is 9.4, and EPSS is 0.00461 as of 2026-10-26.
Synthesised from 3 public sources. Context, not the facts above. Every point is attributed to the publisher that made it.
hol.org and radar.offseq.com both report that this CRLF injection is not known to be exploited, despite the exploit being disclosed publicly. Treat the public disclosure as the near-term risk rather than active campaign activity.
The disclosure notes the vendor was contacted early but did not respond. With no vendor acknowledgement or patch path available, defenders should not wait for an upstream fix and should look for compensating controls instead.
vuldb.com identifies Oray Pugongying X5 Pro 7.6.1, Dnsmasq, and the rent_time argument as the injection point. Monitoring DHCP lease-time handling and outbound responses containing injected line breaks can help spot attempts against this specific path.
What to do
No fixed version is published yet. Apply vendor mitigations or isolate the affected products.
| Product | Fixed version |
|---|---|
| Pugongying X5 Pro | none published |
Why it matters
EPSS estimates a 0.46% chance it is exploited in the next 30 days.
Scores 9.4 out of 10 (CVSSv4.0). That is remote damage without needing an account.
If you run any of the 1 products above and cannot patch today, assume it will be targeted and restrict access in the meantime.
Exploitation
- Status
- No known exploitation
- EPSS
- 0.46% chance of exploitation in 30 days · 39.68% percentile
Analysis
Public sources, summarised. This is context for your decision. The facts above are the ones to act on.
| Source | Adds | Summary |
|---|---|---|
| vuldb.com News | Exploit detail | Names the affected build as Oray Pugongying X5 Pro 7.6.1 and pinpoints the trigger: an unknown function in the Dnsmasq component where manipulating the rent_time argument produces the CRLF injection. |
| radar.offseq.com News | Timeline | Threat Radar gives the disclosure timeline: vulnerability published 26 Oct 2026 with data current as of 26 Oct 2026, 08:41 UTC, sourced from CVE Database V5, and flags it as not known to be exploited. |
| hol.org News | Background | Advisory classifies the Oray Pugongying X5 Pro Dnsmasq CRLF injection as Critical (CVSS 9.4) and explicitly notes current sources do not mark it as known exploited, useful as a status check. |
| radar.offseq.com News | Repeats others | Page for a sibling CVE whose body only lists sibling Oray Pugongying X5 Pro CRLF injection entries (116232, 116231) published 2026-10-26, adding no detail beyond indicating a cluster of related flaws. |
References
- https://vuldb.com/vuln/426282
- https://vuldb.com/vuln/426282/cti
- https://vuldb.com/cve/CVE-2026-116233
- https://vuldb.com/submit/1005081
- https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Dnsmasq-Directive-Injection-Through-DHCP-Lease-Time-3ea797159f1580979394d23087844670
Published
2026-10-26 18:01 UTC · last updated 2026-10-26 18:00 UTC