Pugongying X5 Pro EUVD-2026-109658

Exploitation requires authenticated high-privilege (administrative/configuration) access to the router's IPsec Policy Handler so the attacker can control the secproto argument that is written into /etc/ipsec.conf; CRLF characters in that value are not sanitized, allowing injection of additional IPsec configuration directives that execute as root. The limiting factor is the PR:H requirement - an attacker must already possess elevated/admin credentials or an equivalent configuration foothold on the device, and no user interaction is needed. The flaw is reported against the default-shipping 7.6.1 firmware; no non-default feature toggle is named as a prerequisite in the available sources. No fixed version is published and the vendor has not responded, so no vendor-confirmed mitigation exists.

The input CVSS 4.0 score is 8.5 with vector AV:N/AC:L/AT:N/PR:H/UI:N and full high impact to both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H), consistent with CRLF injection into /etc/ipsec.conf escalating to root-level code execution as claimed by the public PoC reference title. The single most important mitigating signal is PR:H: exploitation requires high privileges (authenticated administrative/configuration access to the router), which sharply reduces the population of attackers who can reach the vulnerable secproto argument and argues against mass, opportunistic exploitation. The vuln.today decision label is 'this_week' - meaningful but explicitly not 'act_now' or 'emergency'. No EPSS score was provided, so exploitation probability cannot be quantified from this data. This is NOT in CISA KEV, and the exploit is a public PoC reference (a Notion page) that the input states is not verified as working exploit code, so there is no confirmation of active exploitation. Net: a genuinely serious flaw (remote, low complexity, full impact, scope change) but gated behind administrative privileges and lacking any evidence of in-the-wild use - prioritize patching/mitigation on affected devices this cycle rather than as an emergency. Note the tension: high CVSS and VulDB's priority versus the PR:H gate and unverified PoC suggest real-but-bounded risk.

An attacker who already holds administrative/configuration access to an Oray Pugongying X5 Pro 7.6.1 router submits a crafted value for the secproto argument containing CRLF characters, which is written unsanitized into /etc/ipsec.conf by the IPsec Policy Handler, injecting additional configuration directives that are executed with root privileges. A public PoC reference describing root code execution via secproto injection exists; it is not verified as working exploit code. Because CVSS specifies PR:H, the attacker must be authenticated with elevated privileges to reach the vulnerable parameter.