CVE-2026-116234
Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection
- Severity
- 9.4CVSSv4.0
- Exploitation
- None seen No known exploitation
- EPSS
- 0.46%as of 2026-10-26
- Products
- 1no fix yet
No known exploitation, and no fixed version published yet.
An attacker can inject CRLF characters into the secproto argument handled by the IPsec Policy Handler, writing attacker-controlled lines into /etc/ipsec.conf on the Oray Pugongying X5 Pro router. The flaw is remotely reachable, carries a CVSSv4.0 score of 9.4, and a public exploit exists; a reference claims this chain yields root code execution on firmware 7.6.1. Administrators should restrict management access and apply any vendor fix when available, since the vendor did not respond to early disclosure.
Synthesised from 3 public sources. Context, not the facts above. Every point is attributed to the publisher that made it.
The CVE description says an exploit is now public and may be used, while hol.org and radar.offseq.com both flag it as not known to be exploited. Treat the 'not known exploited' status as unconfirmed and prioritise patching or mitigation on that basis.
vuldb.com narrows the affected build to Oray Pugongying X5 Pro 7.6.1 and names /etc/ipsec.conf in the IPsec Policy component as the impacted file. Audit the secproto argument values in that file for unexpected or attacker-controlled input.
The disclosure notes the vendor was contacted early but did not respond in any way. Expect no vendor guidance or patch timeline, so plan compensating controls and monitoring yourself rather than waiting on an Oray fix.
What to do
No fixed version is published yet. Apply vendor mitigations or isolate the affected products.
| Product | Fixed version |
|---|---|
| Pugongying X5 Pro | none published |
Why it matters
EPSS estimates a 0.46% chance it is exploited in the next 30 days.
Scores 9.4 out of 10 (CVSSv4.0). That is remote damage without needing an account.
If you run any of the 1 products above and cannot patch today, assume it will be targeted and restrict access in the meantime.
Exploitation
- Status
- No known exploitation
- EPSS
- 0.46% chance of exploitation in 30 days · 39.68% percentile
Analysis
Public sources, summarised. This is context for your decision. The facts above are the ones to act on.
| Source | Adds | Summary |
|---|---|---|
| radar.offseq.com News | Timeline | Threat radar entry giving the publication date of 26 Oct 2026 and a data-as-of timestamp of 26 Oct 2026 08:41 UTC, plus a 'not known to be exploited' status flag for defenders tracking disclosure timing. |
| hol.org News | Background | Advisory framing the issue as a critical CVSS 9.4 crlf injection in the Oray Pugongying X5 Pro IPsec ipsec.conf component, and explicitly noting no source currently marks it as known exploited. |
| vuldb.com News | Background | Names the affected build as Oray Pugongying X5 Pro 7.6.1 and identifies /etc/ipsec.conf in the IPsec Policy component as the impacted file, pinpointing what to inspect on-box. |
| radar.offseq.com News | Repeats others | Lists sibling Oray Pugongying X5 Pro CRLF injection advisories CVE-2026-116231, CVE-2026-116232 and CVE-2026-116233, all flagged Critical and dated 2026-10-26, indicating a batch of related flaws. |
References
- https://vuldb.com/vuln/426283
- https://vuldb.com/vuln/426283/cti
- https://vuldb.com/cve/CVE-2026-116234
- https://vuldb.com/submit/1005082
- https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Root-Code-Execution-via-IPsec-secproto-Injection-3ea797159f1580919c5dea13e5baea84
Published
2026-10-26 17:52 UTC · last updated 2026-10-26 17:51 UTC