exploit.id what's exploited, and what to do

CVE-2026-116237

Oray Pugongying X5 Pro Dnsmasq crlf injection

Severity
9.3CVSSv4.0
Exploitation
None seen No known exploitation
EPSS
0.66%as of 2026-10-26
Products
1no fix yet

No known exploitation, and no fixed version published yet.

An attacker can inject CRLF sequences into the Dnsmasq component of the Oray Pugongying X5 Pro router to run a root script, per the public writeup. The issue is rated CVSSv4.0 9.3 and is remotely reachable, but CISA KEV does not list it and exploitation is none-observed, with an EPSS score of 0.00663 (percentile 0.51409) as of 2026-10-26. The vendor was contacted and did not respond, so owners of X5 Pro devices should monitor for a patch and restrict WAN access to DNS services in the meantime.

What to do

No fixed version is published yet. Apply vendor mitigations or isolate the affected products.

ProductFixed version
Pugongying X5 Pro none published

Why it matters

Likely to spread

EPSS estimates a 0.66% chance it is exploited in the next 30 days.

Severity

Scores 9.3 out of 10 (CVSSv4.0). That is remote damage without needing an account.

Your move

If you run any of the 1 products above and cannot patch today, assume it will be targeted and restrict access in the meantime.

Exploitation

Status
No known exploitation
EPSS
0.66% chance of exploitation in 30 days · 51.41% percentile

Analysis

Public sources, summarised. This is context for your decision. The facts above are the ones to act on.

SourceAddsSummary
hol.org Primary Impact Advisory rates this Critical at CVSS 9.3 and states the flaw is not currently marked as known exploited, useful for prioritization and KEV-checking. No fixed version or mitigation is provided.
radar.offseq.com News Exploit detail Identifies the affected release as Oray Pugongying X5 Pro 7.6.1 and names Dnsmasq as the vulnerable component, noting the injection is triggered by manipulating data passed to it.
vuldb.com News Repeats others States only that the vulnerability was found in Oray Pugongying X5 Pro 7.6.1, a fact already covered by the other sources with more context.

References

  1. https://vuldb.com/vuln/426286
  2. https://vuldb.com/vuln/426286/cti
  3. https://vuldb.com/cve/CVE-2026-116237
  4. https://vuldb.com/submit/1005085
  5. https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-DNS-Group-Newline-Injection-Runs-a-Root-Script-3ea797159f158048a73bf3ba23ccefdb

Published

2026-10-26 18:10 UTC