{"id":"CVE-2026-116234","kind":"vulnerability","aliases":["CVE-2026-116234"],"related":[],"title":"Oray Pugongying X5 Pro: IPsec policy handler lets remote users inject config lines","description":"A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The Oray Pugongying X5 Pro 7.6.1 IPsec Policy Handler does not sanitize the secproto argument, so CRLF characters can be injected into /etc/ipsec.conf. A remote attacker can use this to alter the IPsec configuration, and a public exploit exists.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","ipsec","network-appliance","oray","pugongying"],"not_affected_if":["not-x5-pro","other-firmware"],"how_to_check":"- Check the device firmware version against `7.6.1`\n- Inspect `/etc/ipsec.conf` for unexpected lines after the secproto entries\n- unknown for other checks, the sources do not say","fix":"- unknown: the sources do not say which version fixes this, and the vendor did not respond to disclosure\n- Restrict access to the device's management and IPsec policy interfaces until a fix is available","status":"open","published_at":"2026-10-26T09:16:34+00:00","first_seen_at":"2026-10-26T09:29:15+00:00","triaged_at":"2026-10-26T09:30:44+00:00","updated_at":"2026-10-26T09:30:44+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T09:30:44Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not say which version fixes this, and the vendor did not respond to disclosure\n- Restrict access to the device's management and IPsec policy interfaces until a fix is available","reach":"internet","title":"Oray Pugongying X5 Pro: IPsec policy handler lets remote users inject config lines","impact":"high","summary":"The Oray Pugongying X5 Pro 7.6.1 IPsec Policy Handler does not sanitize the secproto argument, so CRLF characters can be injected into /etc/ipsec.conf. A remote attacker can use this to alter the IPsec configuration, and a public exploit exists.","category":"infrastructure","nicknames":[],"who_cares":["oray","pugongying","ipsec","network-appliance"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote attacker alters IPsec configuration on the appliance","analyst_note":"Confirm the affected firmware range and any vendor or patch status, since the vendor did not respond; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116234 for CVSS vector and auth requirements.","how_to_check":"- Check the device firmware version against `7.6.1`\n- Inspect `/etc/ipsec.conf` for unexpected lines after the secproto entries\n- unknown for other checks, the sources do not say","needs_analyst":true,"not_affected_if":["not-x5-pro","other-firmware"],"who_is_affected":"Teams that run Oray Pugongying X5 Pro devices on firmware 7.6.1 with the IPsec Policy Handler exposed to the network. The sources do not say whether default configurations expose the affected argument. Teams without this device can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000656,"input_tokens":3345,"output_tokens":642,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-116234':16A,19A '-2026':15A,18A '/etc/ipsec.conf':49B,84C '7.6.1':32B,75C 'affect':76C 'alter':57B 'applianc':24B 'argument':41B,95C 'attack':52B,102C 'charact':44B 'compon':87C 'config':12A 'configur':60B 'contact':119C 'crlf':43B,99C 'cve':14A,17A 'detect':69C 'disclosur':123C 'earli':120C 'exist':65B 'exploit':64B,108C 'file':83C 'function':80C 'handler':7A,35B,90C 'infrastructur':20B 'inject':11A,47B,100C 'ipsec':5A,21B,33B,59B,88C 'launch':105C 'let':8A 'line':13A 'manipul':92C 'may':113C 'network':23B 'network-appli':22B 'oray':1A,25B,28B,71C 'polici':6A,34B,89C 'pro':4A,31B,74C 'public':63B,111C 'pugongi':2A,26B,29B,72C 'remot':9A,51B,106C 'respond':127C 'result':97C 'sanit':38B 'secproto':40B,96C 'unknown':79C 'use':54B,115C 'user':10A 'vendor':117C 'vulner':67C 'way':130C 'x5':3A,30B,73C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Oray Pugongying X5 Pro devices on firmware 7.6.1 with the IPsec Policy Handler exposed to the network. The sources do not say whether default configurations expose the affected argument. Teams without this device can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T09:16:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116234","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116234","severity":null,"published_at":"2026-10-26T09:16:34+00:00","modified_at":"2026-10-26T09:16:34+00:00","first_seen_at":"2026-10-26T09:29:15+00:00","fetched_at":"2026-10-26T09:29:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}