---
id: "CVE-2026-116234"
kind: "vulnerability"
aliases: ["CVE-2026-116234"]
title: "Oray Pugongying X5 Pro: IPsec policy handler lets remote users inject config lines"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "ipsec", "network-appliance", "oray", "pugongying"]
not_affected_if: ["not-x5-pro", "other-firmware"]
published_at: "2026-10-26T09:16:34+00:00"
first_seen_at: "2026-10-26T09:29:15+00:00"
updated_at: "2026-10-26T09:30:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116234", "first_seen_at": "2026-10-26T09:29:15+00:00"}]
---

# Oray Pugongying X5 Pro: IPsec policy handler lets remote users inject config lines

The Oray Pugongying X5 Pro 7.6.1 IPsec Policy Handler does not sanitize the secproto argument, so CRLF characters can be injected into /etc/ipsec.conf. A remote attacker can use this to alter the IPsec configuration, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the device firmware version against `7.6.1`
- Inspect `/etc/ipsec.conf` for unexpected lines after the secproto entries
- unknown for other checks, the sources do not say

## Fix

- unknown: the sources do not say which version fixes this, and the vendor did not respond to disclosure
- Restrict access to the device's management and IPsec policy interfaces until a fix is available

## Timeline

- 2026-10-26T09:29:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116234

## From the sources

A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_