{"id":"CVE-2026-116231","kind":"vulnerability","aliases":["CVE-2026-116231"],"related":[],"title":"Oray Pugongying X5 Pro: CRLF injection via regmsg parameter in Ser2net","description":"A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Oray Pugongying X5 Pro 7.6.1 has a flaw in its Ser2net component where the regmsg argument is not sanitized, allowing CRLF injection. The sources say the attack can be launched remotely and a public exploit exists, but they do not describe the resulting impact beyond that.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","network-appliance","oray-pugongying","ser2net"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown; the sources say the vendor did not respond to early disclosure, so no vendor patch is referenced","status":"open","published_at":"2026-10-26T08:17:17+00:00","first_seen_at":"2026-10-26T08:28:59+00:00","triaged_at":"2026-10-26T08:30:19+00:00","updated_at":"2026-10-26T08:30:19+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-26T08:30:19Z","model":"claude-haiku-5-5","output":{"fix":"- unknown; the sources say the vendor did not respond to early disclosure, so no vendor patch is referenced","reach":"internet","title":"Oray Pugongying X5 Pro: CRLF injection via regmsg parameter in Ser2net","impact":"medium","summary":"Oray Pugongying X5 Pro 7.6.1 has a flaw in its Ser2net component where the regmsg argument is not sanitized, allowing CRLF injection. The sources say the attack can be launched remotely and a public exploit exists, but they do not describe the resulting impact beyond that.","category":"infrastructure","nicknames":[],"who_cares":["oray-pugongying","ser2net","network-appliance"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; CRLF injection enables protocol manipulation, impact not specified","analyst_note":"Find the NVD entry and any vendor or advisory detail on what the regmsg CRLF injection enables and which Ser2net configuration is exposed; confirm whether a fixed version or workaround exists.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running Oray Pugongying X5 Pro version 7.6.1 with the Ser2net component exposed to the network. The sources do not say which configurations are affected beyond the product and version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000589,"input_tokens":3345,"output_tokens":509,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-116231':14A,17A '-2026':13A,16A '7.6.1':30B,82C 'allow':45B 'applianc':21B 'argument':41B,99C 'attack':52B,111C,126C 'beyond':70B 'compon':37B,92C 'contact':130C 'crlf':5A,46B,103C 'cve':12A,15A 'describ':66B 'disclosur':134C 'discov':76C 'earli':131C 'element':85C 'exist':61B 'exploit':60B,114C 'flaw':33B,73C 'function':89C 'impact':69B,84C 'infrastructur':18B 'initi':109C 'inject':6A,47B,104C 'launch':55B 'manipul':96C 'may':122C 'network':20B 'network-appli':19B 'oray':1A,23B,26B,78C 'oray-pugongi':22B 'paramet':9A 'perform':94C 'possibl':107C 'pro':4A,29B,81C 'public':59B,120C 'pugongi':2A,24B,27B,79C 'regmsg':8A,40B,100C 'releas':117C 'remot':56B,112C 'respond':138C 'result':68B,101C 'sanit':44B 'say':50B 'secur':72C 'ser2net':11A,25B,36B,93C 'sourc':49B 'unknown':88C 'use':124C 'vendor':128C 'via':7A 'way':141C 'x5':3A,28B,80C","nicknames":[],"mitigations":[],"who_affected":"Systems running Oray Pugongying X5 Pro version 7.6.1 with the Ser2net component exposed to the network. The sources do not say which configurations are affected beyond the product and version.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T08:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116231","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116231","severity":null,"published_at":"2026-10-26T08:17:17+00:00","modified_at":"2026-10-26T08:17:17+00:00","first_seen_at":"2026-10-26T08:28:59+00:00","fetched_at":"2026-10-26T08:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}