Pugongying X5 Pro CVE-2026-116237

Exploitation requires authenticated administrative access to the router's DNS group configuration feature (PR:H) and passive user interaction (UI:P) - it is not a remote unauthenticated attack against default configurations. The specific prerequisite is the ability to create or modify a DNS group entry in which CR/LF (newline) characters can be injected, per the referenced PoC, causing the injected content to be executed as a root script. Limiting factors: the attacker must first obtain router admin credentials or an authenticated session, so exposure depends heavily on whether the management interface is network-reachable and how well admin access is protected; this is confined to Oray Pugongying X5 Pro 7.6.1. No vendor patch is listed, and the vendor did not respond to disclosure, so no official fixed version or mitigation is confirmed.

This is a genuine but conditional risk rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P) requires high privileges (PR:H) - i.e. an authenticated administrator with access to the router's DNS group configuration - plus passive user interaction, which substantially narrows the attacker population compared to an unauthenticated RCE. Against that, the technical impact is severe: full confidentiality, integrity and availability loss on both the vulnerable and subsequent systems (VC/VI/VA:H, SC/SI/SA:H), consistent with the exploit reference's claim that a newline-injected DNS group entry causes a root script to run. The vuln.today decision label is 'this_week', not act_now/emergency, and exploitation maturity is E:P (proof-of-concept). No EPSS score and no KEV listing were supplied, so there is no evidence of active exploitation in the wild - the signals point to a credible privilege-to-root escalation path on a specific device rather than mass exploitation. Note the tension between PR:H (admin already needed) and the scope-change-to-root impact: the real value to an attacker is turning admin/config access into persistent root, which should be weighed against how exposed router admin interfaces are in a given deployment.

An attacker who already holds router administrator access (or who reaches the admin interface via weak/default credentials or a session) adds or edits a DNS group entry containing injected CR/LF (newline) characters, per CWE-93. The crafted entry breaks out of its intended field and causes the underlying Dnsmasq-related handling to execute an attacker-controlled script as root, yielding full device takeover. A public PoC reference exists (a Notion write-up titled 'DNS Group Newline Injection Runs a Root Script'); it is not verified as working exploit code.