{"id":"CVE-2026-116233","kind":"vulnerability","aliases":["CVE-2026-116233"],"related":[],"title":"Oray Pugongying X5 Pro: Dnsmasq rent_time input enables CRLF injection remotely","description":"A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The Oray Pugongying X5 Pro 7.6.1 router firmware's Dnsmasq component does not sanitize the rent_time argument, allowing CRLF injection. A remote attacker can use this to inject arbitrary content into the device's handling of that input, and a public exploit has been disclosed.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dnsmasq","infrastructure","oray","pugongying-x5-pro","routers","self-hosted"],"not_affected_if":["other-hardware"],"how_to_check":"- Check the installed firmware version on the device (Oray Pugongying X5 Pro) and see whether it is exactly `7.6.1`\n- unknown for any further check: the sources do not describe a specific setting or file to inspect","fix":"- unknown: the sources do not name a patched firmware version or vendor fix; the vendor did not respond to early disclosure\n- Restrict remote access to the device's management interface until a fix is available","status":"open","published_at":"2026-10-26T09:16:34+00:00","first_seen_at":"2026-10-26T09:29:15+00:00","triaged_at":"2026-10-26T09:30:44+00:00","updated_at":"2026-10-26T09:30:44+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T09:30:44Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a patched firmware version or vendor fix; the vendor did not respond to early disclosure\n- Restrict remote access to the device's management interface until a fix is available","reach":"internet","title":"Oray Pugongying X5 Pro: Dnsmasq rent_time input enables CRLF injection remotely","impact":"medium","summary":"The Oray Pugongying X5 Pro 7.6.1 router firmware's Dnsmasq component does not sanitize the rent_time argument, allowing CRLF injection. A remote attacker can use this to inject arbitrary content into the device's handling of that input, and a public exploit has been disclosed.","category":"infrastructure","nicknames":[],"who_cares":["oray","pugongying-x5-pro","dnsmasq","routers","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote attacker injects content into device DHCP handling, possibly controlling the device","analyst_note":"Confirm the exposed interface, whether authentication is needed, and the real impact of CRLF injection on this firmware; check the NVD entry and any vendor or exploit write-up for details.","how_to_check":"- Check the installed firmware version on the device (Oray Pugongying X5 Pro) and see whether it is exactly `7.6.1`\n- unknown for any further check: the sources do not describe a specific setting or file to inspect","needs_analyst":true,"not_affected_if":["other-hardware"],"who_is_affected":"Owners of Oray Pugongying X5 Pro devices running firmware 7.6.1 are the ones named in the sources; the Dnsmasq rent_time argument is the entry point. Whether the flaw is reachable depends on the device exposing that input over the network, which the sources do not confirm. Teams running other router or networking products can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00067,"input_tokens":3341,"output_tokens":671,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-116233':15A,18A '-2026':14A,17A '7.6.1':35B,87C 'allow':48B 'arbitrari':59B 'argument':47B,101C 'attack':53B,109C 'compon':40B,95C 'contact':127C 'content':60B 'crlf':10A,49B,106C 'cve':13A,16A 'detect':81C 'devic':63B 'disclos':75B,118C 'disclosur':131C 'dnsmasq':5A,19B,39B,96C 'earli':128C 'enabl':9A 'exploit':72B,115C 'firmwar':37B 'function':92C 'handl':65B 'host':29B 'impact':89C 'infrastructur':20B 'initi':112C 'inject':11A,50B,58B,107C 'input':8A,68B 'lead':104C 'manipul':98C 'may':121C 'oray':1A,21B,31B,83C 'pro':4A,25B,34B,86C 'public':71B,119C 'pugongi':2A,23B,32B,84C 'pugongying-x5-pro':22B 'remot':12A,52B,113C 'rent':6A,45B,102C 'respond':135C 'router':26B,36B 'sanit':43B 'secur':77C 'self':28B 'self-host':27B 'time':7A,46B,103C 'unknown':91C 'use':55B,123C 'vendor':125C 'vulner':78C 'way':138C 'x5':3A,24B,33B,85C","nicknames":[],"mitigations":[],"who_affected":"Owners of Oray Pugongying X5 Pro devices running firmware 7.6.1 are the ones named in the sources; the Dnsmasq rent_time argument is the entry point. Whether the flaw is reachable depends on the device exposing that input over the network, which the sources do not confirm. Teams running other router or networking products can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T09:16:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116233","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116233","severity":null,"published_at":"2026-10-26T09:16:34+00:00","modified_at":"2026-10-26T09:16:34+00:00","first_seen_at":"2026-10-26T09:29:15+00:00","fetched_at":"2026-10-26T09:29:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}