Live › vulnerability › CVE-2026-116233
Go to dashboardThe Oray Pugongying X5 Pro 7.6.1 router firmware's Dnsmasq component does not sanitize the rent_time argument, allowing CRLF injection. A remote attacker can use this to inject arbitrary content into the device's handling of that input, and a public exploit has been disclosed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 09:29 UTC. All times on this page are UTC.
Owners of Oray Pugongying X5 Pro devices running firmware 7.6.1 are the ones named in the sources; the Dnsmasq rent_time argument is the entry point. Whether the flaw is reachable depends on the device exposing that input over the network, which the sources do not confirm. Teams running other router or networking products can skip it.
No product ranges from the sources yet.
7.6.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116233")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.