{"id":"CVE-2026-116237","kind":"vulnerability","aliases":["CVE-2026-116237"],"related":[],"title":"Oray Pugongying X5 Pro: Dnsmasq CRLF injection flaw reachable remotely","description":"A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Oray Pugongying X5 Pro 7.6.1 ships a Dnsmasq component with a flaw that lets an attacker inject CRLF sequences. The exploit is public and the attack can be triggered remotely.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dnsmasq","infrastructure","network-appliance","oray","pugongying"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-26T10:16:52+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","triaged_at":"2026-10-26T10:30:46+00:00","updated_at":"2026-10-26T10:30:46+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T10:30:46Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Oray Pugongying X5 Pro: Dnsmasq CRLF injection flaw reachable remotely","impact":"medium","summary":"Oray Pugongying X5 Pro 7.6.1 ships a Dnsmasq component with a flaw that lets an attacker inject CRLF sequences. The exploit is public and the attack can be triggered remotely.","category":"infrastructure","nicknames":[],"who_cares":["oray","pugongying","dnsmasq","network-appliance"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown attacker actions through injected CRLF sequences in the device","analyst_note":"Check https://nvd.nist.gov/vuln/detail/CVE-2026-116237 for the affected component path, a vendor fix or mitigation, and whether the device is reachable from the internet by default.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running Oray Pugongying X5 Pro firmware 7.6.1 with the affected Dnsmasq component. The sources do not say which part of the component is affected or whether default configuration is exposed. The vendor did not respond to early disclosure, so no vendor fix is confirmed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000575,"input_tokens":3325,"output_tokens":484,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116237':13A,16A '-2026':12A,15A '7.6.1':28B,63C 'affect':65C 'applianc':21B 'attack':39B,49B,84C 'compon':32B,71C 'contact':100C 'could':94C 'crlf':6A,41B,78C 'cve':11A,14A 'disclosur':104C 'dnsmasq':5A,17B,31B,72C 'earli':101C 'exploit':44B,81C,88C 'flaw':8A,35B 'found':57C 'infrastructur':18B 'inject':7A,40B,79C 'let':37B 'made':91C 'manipul':75C 'network':20B 'network-appli':19B 'oray':1A,22B,24B,59C 'part':68C 'perform':73C 'possibl':86C 'pro':4A,27B,62C 'public':46B,92C 'pugongi':2A,23B,25B,60C 'reachabl':9A 'remot':10A,53B,80C 'respond':108C 'result':76C 'sequenc':42B 'ship':29B 'trigger':52B 'unknown':67C 'use':96C 'vendor':98C 'vulner':55C 'way':111C 'x5':3A,26B,61C","nicknames":[],"mitigations":[],"who_affected":"Systems running Oray Pugongying X5 Pro firmware 7.6.1 with the affected Dnsmasq component. The sources do not say which part of the component is affected or whether default configuration is exposed. The vendor did not respond to early disclosure, so no vendor fix is confirmed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T10:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116237","severity":null,"published_at":"2026-10-26T10:16:52+00:00","modified_at":"2026-10-26T10:16:52+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","fetched_at":"2026-10-26T10:29:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}