Pugongying X5 Pro EUVD-2026-109672

Exploitation targets the L2TP Authentication component and requires the attacker to control the L2TP Username argument submitted during authentication; the CVSS vector assigns PR:H, so elevated privileges or authenticated/configuration-level access to the device's L2TP setup are required rather than fully anonymous access. No user interaction is needed (UI:N) and the attack is network-initiated (AV:N) with low complexity (AC:L). The limiting factors are the high-privilege precondition and that only the Oray Pugongying X5 Pro firmware 7.6.1 is identified as affected; the precise configuration state that renders the L2TP username field injectable is not described in the available sources.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) describes a network-reachable, low-complexity issue that nonetheless requires high privileges (PR:H), with full confidentiality, integrity and availability impact on both the vulnerable and subsequent systems (VC/VI/VA:H, SC/SI/SA:H), yielding a base score of 8.5. The exploitation maturity is E:P (proof-of-concept), consistent with the input stating a public PoC reference exists that is not verified as working exploit code. This is NOT CISA KEV-listed and no EPSS probability was provided, so there is no evidence of active or widespread exploitation; the signals point to a disclosed-but-not-confirmed-weaponized issue. The vuln.today decision label is 'this_week', indicating meaningful but not emergency urgency. The key tension is PR:H versus the reported impact: the vendor vector itself requires high privileges, so despite the high score this is not a trivial unauthenticated remote takeover - an attacker must already have the privilege to supply/control the L2TP Username. The linked exploit reference is titled as root code execution via L2TP username injection, which is more severe than a bare CRLF (CWE-93) label suggests, but the trigger mechanism beyond 'manipulation of the Username argument causes CRLF injection' is not described in the available sources, and the escalation from CRLF to root code execution is not corroborated by a vendor advisory. Treat as a genuine priority for exposed Oray devices, but note the vendor did not respond and no fix is documented.

An attacker with the required privilege to influence the L2TP authentication exchange supplies a crafted Username containing CR/LF sequences, injecting additional control data into the L2TP authentication handling of an Oray Pugongying X5 Pro router. Per the linked exploit reference, this is claimed to lead to root-level code execution on the device, though that escalation is not independently confirmed. A public PoC reference exists; it is not verified as working exploit code.