Pugongying X5 Pro EUVD-2026-109657

Requires administrative (PR:H) access to the Oray Pugongying X5 Pro management interface in order to set the rent_time (DHCP lease time) parameter; supplying CRLF sequences in that value injects arbitrary directives into the device's Dnsmasq configuration. The exploitation is remote over the network (AV:N) and needs no user interaction (UI:N), but the high-privilege authentication requirement is the primary limiting factor - an unauthenticated outsider cannot reach the vulnerable parameter without first obtaining admin credentials. Beyond the manipulation of rent_time leading to CRLF injection, the precise trigger internals are not described in the available sources. No fixed version is available because the vendor did not respond to the disclosure.

The CVSS 4.0 base score of 8.5 looks high, but the single most important mitigating signal is PR:H in the vector - exploitation requires high privileges, i.e. an authenticated administrator on the router's management interface, so this is a post-authentication / config-dependent flaw rather than a remote-unauthenticated one. There is no CISA KEV listing and no EPSS score in the supplied data, so there is no evidence of widespread or active exploitation; exploit maturity in the vector is E:P (proof-of-concept). The vuln.today decision label is 'this_week', which is an elevated-but-not-emergency priority, consistent with the PR:H gating and PoC-stage maturity. A public PoC reference exists (a Notion write-up) but it is not verified as working exploit code, so POC availability must not be conflated with active exploitation. Netting these signals: this is a genuine high-severity issue for anyone who can reach the router admin interface, but the admin-privilege prerequisite and the niche deployment footprint place it well below internet-facing unauthenticated RCE in real-world urgency. No KEV/EPSS data is present to confirm or refute real-world exploitation - treat the risk as targeted/opportunistic post-compromise rather than mass-exploitable.

An attacker who already holds administrative access to an Oray Pugongying X5 Pro (7.6.1) web management interface manipulates the rent_time (DHCP lease time) parameter, embedding CRLF sequences that inject additional directives into the device's Dnsmasq configuration. This lets the attacker alter DNS/DHCP behaviour for all clients served by the router. A public PoC reference exists; it is not verified as working exploit code.