Pugongying X5 Pro EUVD-2026-109655

Exploitation requires low-privileged authenticated access to the Oray Pugongying X5 Pro (7.6.1) management/SNMP configuration so the attacker can set the info.community argument handled by snmp_set in the SNMP Handler; because snmpd runs as root, a CRLF (newline) sequence injected into that community value breaks the field boundary and results in command execution as root. Limiting factors: the attacker must already hold authenticated access (PR:L) to reach the SNMP configuration, and exploitation targets this specific router firmware version - it is not an unauthenticated internet-wide drive-by. No special user interaction is required (UI:N).

The CVSS 4.0 base score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw needing only low-privileged authentication, with high impact to both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H) - consistent with the exploit reference's claim that a newline in the SNMP community value causes snmpd to execute commands as root. Exploit maturity is E:P (proof-of-concept), and the vuln.today decision label is 'this_week', indicating a prompt but non-emergency priority. This is NOT in CISA KEV, so there is no evidence of active exploitation, and no EPSS probability was supplied, so widespread automated exploitation cannot be scored from the available data. The signals are internally consistent (network vector, low privilege, PoC-grade maturity) rather than conflicting, but note that PR:L assumes the attacker already holds authenticated access to the router's SNMP/management configuration - a real limiting factor that a raw 8.6 does not convey. Treat this as a genuine high-severity, authenticated remote root path on the affected device, prioritized for this week rather than as an emergency.

An attacker with low-privileged authenticated access to the router's management configures the SNMP handler and supplies an info.community value containing CRLF characters; because snmpd runs as root, the injected newline lets the attacker break out of the community field and have commands executed with root privileges. A public PoC reference (a Notion write-up titled 'A Community Newline Makes snmpd Run Commands as Root') describes this path, though it is not verified as working exploit code. The CVSS AV:N/AC:L/PR:L/UI:N profile means exploitation is remote, low-complexity, and needs no user interaction once the attacker is authenticated.