Monthly
CRLF injection in the Dnsmasq-related DNS group configuration of Oray Pugongying X5 Pro 7.6.1 can let an attacker with authenticated administrative access inject newline sequences that, per the referenced PoC, are executed as a root script, with high confidentiality, integrity, and availability impact. Exploitation requires administrative access to the DNS group feature plus user interaction, so exposure depends on whether the management interface is reachable and how well admin access is protected; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV confirmation was provided. The vendor did not respond to disclosure and no official fixed version is listed, making this a conditional risk rather than a drop-everything emergency.
A CRLF injection (CWE-93) in the L2TP Authentication component of the Oray Pugongying X5 Pro router running firmware 7.6.1 allows an attacker who controls the L2TP Username argument to insert carriage-return/line-feed sequences into authentication handling, which the vendor-tagged data classifies as code injection and the published reference describes as reaching root code execution. The CVSS 4.0 vector scores 8.5 (AV:N/AC:L/AT:N/PR:H/UI:N) with high confidentiality, integrity and availability impact on both the vulnerable device and subsequent systems, but exploitation requires high privileges (PR:H) - authenticated or configuration-level access to the device's L2TP setup - rather than anonymous reach. A public PoC reference exists (a Notion write-up titled for root code execution via L2TP username injection); it is not verified as working exploit code, and there is no CISA KEV listing, though the current priority decision is to remediate this week. The vendor was contacted about the disclosure and did not respond.
CRLF injection in the IPsec Policy Handler of Oray Pugongying X5 Pro 7.6.1 allows an authenticated high-privilege administrator to place unsanitized secproto values into /etc/ipsec.conf and inject additional IPsec configuration directives that execute as root. The CVSS 4.0 score is 8.5 with PR:H and no user interaction, and the independent assessment rates confidentiality, integrity and availability impact as high for both the device and downstream systems. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV entry is provided, the vendor did not respond, and no fixed version is published.
CRLF injection in the Dnsmasq configuration path of Oray Pugongying X5 Pro 7.6.1 lets a user who already holds administrative access to the router's management interface inject newline-delimited Dnsmasq directives through the DHCP lease-time (rent_time) parameter, corrupting the device's DNS/DHCP behaviour and enabling configuration tampering and potential information disclosure. Exploitation is remote over the network with no user interaction, but the CVSS vector carries PR:H - an attacker must first obtain admin credentials, which is the primary limiting factor, so this is not reachable by an unauthenticated outsider. A public PoC reference (a Notion write-up titled 'Dnsmasq Directive Injection Through DHCP Lease Time') exists but is not verified as working exploit code; the vendor was contacted and did not respond, so no fixed version is available, and the disclosure is tracked for remediation this week.
CRLF injection in the SNMP Handler of Oray Pugongying X5 Pro 7.6.1 lets a low-privileged authenticated user inject newline sequences through the info.community argument handled by snmp_set, potentially causing the root-running snmpd to execute commands as root. The issue is network reachable, requires authentication (CVSS 4.0 score 8.6, PR:L), and affects both the router and subsequent systems; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV active exploitation is reported. The vendor was contacted early about the disclosure and did not respond, and no vendor-released patch is identified at time of analysis.
CRLF injection in the ser2net serial-handling component of Oray Pugongying X5 Pro 7.6.1 lets a network-positioned attacker with low-level privileges manipulate the regmsg argument so that an unescaped newline sequence in a serial banner overwrites an existing file on the device. The vendor-supplied CVSS 4.0 score is 8.6 (High); the independently assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H, reflecting high integrity and availability impact with lower confidentiality impact, and requiring PR:L - the attacker must already hold a low-privilege foothold/authentication on the device rather than being fully unauthenticated. No CISA KEV entry exists and no EPSS value was supplied; a public PoC reference exists, but it is not verified as working exploit code. The vendor was contacted and did not respond, so no official fix or vendor-stated mitigation is documented.
IMAP command injection in Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows an authenticated remote user to inject CRLF sequences through the _flag parameter of the mail/mark action and execute arbitrary IMAP commands in their mail session. The CVSS 3.1 score is 7.1 (High) with PR:L, and default installations are vulnerable because mail/mark is available to normal logged-in users, so risk centers on compromised accounts, malicious insiders, or credentialed attackers rather than anonymous scanning. Vendor fixes are available in 1.6.20 and 1.7.5; no public exploit identified at time of analysis and no CISA KEV confirmation was provided.
Authenticated command injection in ArmorX Spam allows remote users with low-privilege accounts to submit crafted parameter input and cause malicious code to be uploaded to the server, with the assessed impact concentrated on integrity rather than confidentiality or availability. The CVSS 4.0 base score is 7.1 and the aligned CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:N, reflecting network reachability, low attack complexity, low privileges, and no user interaction. No public exploit identified at time of analysis, and no CISA KEV or EPSS data was provided; exposure depends on how broadly authenticated accounts are provisioned and whether the vulnerable interface is network-accessible.
IMAP command injection in Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 lets a remote authenticated attacker inject CRLF sequences into the _uid parameter of the mail/headers and mail/viewsource actions and execute arbitrary IMAP commands within their own webmail session. The flaw requires a valid Roundcube login (CVSS PR:L) and is exploitable in default configurations; it has high integrity impact but limited confidentiality impact, and no public exploit was identified at time of analysis. Vendor-released patches 1.6.20 and 1.7.5 address the 1.6 and 1.7 branches.
Authenticated pfSense CE administrators with General Setup privileges can achieve root-level PHP code execution by injecting an auto_prepend_file directive into php.ini through an unvalidated timezone value. Publicly available exploit code exists, but exploitation is conditional: the injected directive only runs after php.ini is regenerated at boot or on a php-fpm restart, and the attacker already holds administrator-equivalent access, making this a post-authentication privilege escalation rather than an unauthenticated remote compromise or mass-exploitation threat. Netgate pfSense CE through 2.9.0 is affected.
CRLF injection in the Dnsmasq-related DNS group configuration of Oray Pugongying X5 Pro 7.6.1 can let an attacker with authenticated administrative access inject newline sequences that, per the referenced PoC, are executed as a root script, with high confidentiality, integrity, and availability impact. Exploitation requires administrative access to the DNS group feature plus user interaction, so exposure depends on whether the management interface is reachable and how well admin access is protected; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV confirmation was provided. The vendor did not respond to disclosure and no official fixed version is listed, making this a conditional risk rather than a drop-everything emergency.
A CRLF injection (CWE-93) in the L2TP Authentication component of the Oray Pugongying X5 Pro router running firmware 7.6.1 allows an attacker who controls the L2TP Username argument to insert carriage-return/line-feed sequences into authentication handling, which the vendor-tagged data classifies as code injection and the published reference describes as reaching root code execution. The CVSS 4.0 vector scores 8.5 (AV:N/AC:L/AT:N/PR:H/UI:N) with high confidentiality, integrity and availability impact on both the vulnerable device and subsequent systems, but exploitation requires high privileges (PR:H) - authenticated or configuration-level access to the device's L2TP setup - rather than anonymous reach. A public PoC reference exists (a Notion write-up titled for root code execution via L2TP username injection); it is not verified as working exploit code, and there is no CISA KEV listing, though the current priority decision is to remediate this week. The vendor was contacted about the disclosure and did not respond.
CRLF injection in the IPsec Policy Handler of Oray Pugongying X5 Pro 7.6.1 allows an authenticated high-privilege administrator to place unsanitized secproto values into /etc/ipsec.conf and inject additional IPsec configuration directives that execute as root. The CVSS 4.0 score is 8.5 with PR:H and no user interaction, and the independent assessment rates confidentiality, integrity and availability impact as high for both the device and downstream systems. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV entry is provided, the vendor did not respond, and no fixed version is published.
CRLF injection in the Dnsmasq configuration path of Oray Pugongying X5 Pro 7.6.1 lets a user who already holds administrative access to the router's management interface inject newline-delimited Dnsmasq directives through the DHCP lease-time (rent_time) parameter, corrupting the device's DNS/DHCP behaviour and enabling configuration tampering and potential information disclosure. Exploitation is remote over the network with no user interaction, but the CVSS vector carries PR:H - an attacker must first obtain admin credentials, which is the primary limiting factor, so this is not reachable by an unauthenticated outsider. A public PoC reference (a Notion write-up titled 'Dnsmasq Directive Injection Through DHCP Lease Time') exists but is not verified as working exploit code; the vendor was contacted and did not respond, so no fixed version is available, and the disclosure is tracked for remediation this week.
CRLF injection in the SNMP Handler of Oray Pugongying X5 Pro 7.6.1 lets a low-privileged authenticated user inject newline sequences through the info.community argument handled by snmp_set, potentially causing the root-running snmpd to execute commands as root. The issue is network reachable, requires authentication (CVSS 4.0 score 8.6, PR:L), and affects both the router and subsequent systems; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV active exploitation is reported. The vendor was contacted early about the disclosure and did not respond, and no vendor-released patch is identified at time of analysis.
CRLF injection in the ser2net serial-handling component of Oray Pugongying X5 Pro 7.6.1 lets a network-positioned attacker with low-level privileges manipulate the regmsg argument so that an unescaped newline sequence in a serial banner overwrites an existing file on the device. The vendor-supplied CVSS 4.0 score is 8.6 (High); the independently assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H, reflecting high integrity and availability impact with lower confidentiality impact, and requiring PR:L - the attacker must already hold a low-privilege foothold/authentication on the device rather than being fully unauthenticated. No CISA KEV entry exists and no EPSS value was supplied; a public PoC reference exists, but it is not verified as working exploit code. The vendor was contacted and did not respond, so no official fix or vendor-stated mitigation is documented.
IMAP command injection in Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows an authenticated remote user to inject CRLF sequences through the _flag parameter of the mail/mark action and execute arbitrary IMAP commands in their mail session. The CVSS 3.1 score is 7.1 (High) with PR:L, and default installations are vulnerable because mail/mark is available to normal logged-in users, so risk centers on compromised accounts, malicious insiders, or credentialed attackers rather than anonymous scanning. Vendor fixes are available in 1.6.20 and 1.7.5; no public exploit identified at time of analysis and no CISA KEV confirmation was provided.
Authenticated command injection in ArmorX Spam allows remote users with low-privilege accounts to submit crafted parameter input and cause malicious code to be uploaded to the server, with the assessed impact concentrated on integrity rather than confidentiality or availability. The CVSS 4.0 base score is 7.1 and the aligned CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:N, reflecting network reachability, low attack complexity, low privileges, and no user interaction. No public exploit identified at time of analysis, and no CISA KEV or EPSS data was provided; exposure depends on how broadly authenticated accounts are provisioned and whether the vulnerable interface is network-accessible.
IMAP command injection in Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 lets a remote authenticated attacker inject CRLF sequences into the _uid parameter of the mail/headers and mail/viewsource actions and execute arbitrary IMAP commands within their own webmail session. The flaw requires a valid Roundcube login (CVSS PR:L) and is exploitable in default configurations; it has high integrity impact but limited confidentiality impact, and no public exploit was identified at time of analysis. Vendor-released patches 1.6.20 and 1.7.5 address the 1.6 and 1.7 branches.
Authenticated pfSense CE administrators with General Setup privileges can achieve root-level PHP code execution by injecting an auto_prepend_file directive into php.ini through an unvalidated timezone value. Publicly available exploit code exists, but exploitation is conditional: the injected directive only runs after php.ini is regenerated at boot or on a php-fpm restart, and the attacker already holds administrator-equivalent access, making this a post-authentication privilege escalation rather than an unauthenticated remote compromise or mass-exploitation threat. Netgate pfSense CE through 2.9.0 is affected.