Pugongying X5 Pro CVE-2026-116231

Exploitation requires reaching the ser2net component and supplying a crafted regmsg argument whose serial banner contains unescaped CRLF/newline sequences, which causes ser2net to overwrite an existing file; the CVSS vector specifies PR:L, so the attacker must hold low-level privileges/authentication on the device rather than being fully unauthenticated. Limiting factors: the target must be running the vulnerable Oray Pugongying X5 Pro 7.6.1 firmware with the ser2net serial-handling path active and network-reachable, and the attacker needs that low-privilege foothold; no user interaction is required (UI:N). Because the vendor did not respond, no official fix or vendor-stated mitigation is documented - only avoiding exposure of the affected service reduces risk.

The CVSS 4.0 base score of 8.6 (High) reflects a network-reachable flaw (AV:N/AC:L/AT:N) that requires some privilege (PR:L) and no user interaction, with the vendor-supplied vector claiming full compromise of both the vulnerable and subsequent systems (VC/VI/VA:H, SC/SI/SA:H). The exploit-maturity metric is E:P (proof-of-concept), consistent with the intelligence that a PoC reference exists but is not verified as working exploit code. This is NOT confirmed actively exploited: there is no CISA KEV listing and no EPSS probability was supplied, so widespread or automated exploitation cannot be asserted - the only priority signal is the vuln.today 'this_week' decision label, which is urgent but below emergency/act_now. Two tensions are worth flagging: (1) the vendor rated full confidentiality/integrity/availability impact AND a scope change (SC/SI/SA:H), yet the only documented mechanism (per the exploit reference) is that a serial-banner newline lets ser2net overwrite existing files - a file-overwrite primitive maps cleanly to integrity/availability but the high confidentiality and subsequent-system ratings are not substantiated by the available evidence and should be treated as the reporter's assessment, not confirmed fact; (2) the vendor was contacted but did not respond, so no patch exists, which raises real-world risk for exposed deployments despite the modest priority label. Net: a genuine High-severity, authenticated, remotely reachable issue on an unpatched product, but not a mass-exploitation emergency on current signals.

An attacker with low-privileged access to the Oray Pugongying X5 Pro router (7.6.1) supplies a crafted value to the regmsg argument containing CRLF sequences; because the serial banner newline is not neutralized, ser2net interprets the injected line and overwrites an existing file on the device. A public PoC reference exists but is not verified as working exploit code, and the network attack vector (AV:N) with low complexity (AC:L) means the manipulation can be delivered remotely once the required privilege is held.