---
id: "CVE-2026-116233"
kind: "vulnerability"
aliases: ["CVE-2026-116233"]
title: "Oray Pugongying X5 Pro: Dnsmasq rent_time input enables CRLF injection remotely"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["dnsmasq", "infrastructure", "oray", "pugongying-x5-pro", "routers", "self-hosted"]
not_affected_if: ["other-hardware"]
published_at: "2026-10-26T09:16:34+00:00"
first_seen_at: "2026-10-26T09:29:15+00:00"
updated_at: "2026-10-26T09:30:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116233", "first_seen_at": "2026-10-26T09:29:15+00:00"}]
---

# Oray Pugongying X5 Pro: Dnsmasq rent_time input enables CRLF injection remotely

The Oray Pugongying X5 Pro 7.6.1 router firmware's Dnsmasq component does not sanitize the rent_time argument, allowing CRLF injection. A remote attacker can use this to inject arbitrary content into the device's handling of that input, and a public exploit has been disclosed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed firmware version on the device (Oray Pugongying X5 Pro) and see whether it is exactly `7.6.1`
- unknown for any further check: the sources do not describe a specific setting or file to inspect

## Fix

- unknown: the sources do not name a patched firmware version or vendor fix; the vendor did not respond to early disclosure
- Restrict remote access to the device's management interface until a fix is available

## Timeline

- 2026-10-26T09:29:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116233

## From the sources

A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_