Oray
Monthly
CRLF injection in the Dnsmasq-related DNS group configuration of Oray Pugongying X5 Pro 7.6.1 can let an attacker with authenticated administrative access inject newline sequences that, per the referenced PoC, are executed as a root script, with high confidentiality, integrity, and availability impact. Exploitation requires administrative access to the DNS group feature plus user interaction, so exposure depends on whether the management interface is reachable and how well admin access is protected; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV confirmation was provided. The vendor did not respond to disclosure and no official fixed version is listed, making this a conditional risk rather than a drop-everything emergency.
Unrestricted file upload in the PPPoE WAN Setting Handler of Oray Pugongying X5 Pro 7.6.1 lets an attacker who already holds administrative access to the router management interface manipulate the pppd_options argument so that plugin_init writes attacker-controlled content to /tmp/upload_files, ultimately enabling code execution on the device. Per the vendor CVSS vector the attack is network-reachable and low-complexity but requires high privileges (PR:H), which is the main limiting factor. A public PoC reference exists (a Notion write-up describing root code execution via the PPPoE plugin option) but it is not verified as working exploit code, and the vendor was contacted about the disclosure without responding, so no patch is available. This is a genuine but lower-tier priority rather than a drop-everything emergency, though it should be handled this week.
A CRLF injection (CWE-93) in the L2TP Authentication component of the Oray Pugongying X5 Pro router running firmware 7.6.1 allows an attacker who controls the L2TP Username argument to insert carriage-return/line-feed sequences into authentication handling, which the vendor-tagged data classifies as code injection and the published reference describes as reaching root code execution. The CVSS 4.0 vector scores 8.5 (AV:N/AC:L/AT:N/PR:H/UI:N) with high confidentiality, integrity and availability impact on both the vulnerable device and subsequent systems, but exploitation requires high privileges (PR:H) - authenticated or configuration-level access to the device's L2TP setup - rather than anonymous reach. A public PoC reference exists (a Notion write-up titled for root code execution via L2TP username injection); it is not verified as working exploit code, and there is no CISA KEV listing, though the current priority decision is to remediate this week. The vendor was contacted about the disclosure and did not respond.
CRLF injection in the IPsec Policy Handler of Oray Pugongying X5 Pro 7.6.1 allows an authenticated high-privilege administrator to place unsanitized secproto values into /etc/ipsec.conf and inject additional IPsec configuration directives that execute as root. The CVSS 4.0 score is 8.5 with PR:H and no user interaction, and the independent assessment rates confidentiality, integrity and availability impact as high for both the device and downstream systems. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV entry is provided, the vendor did not respond, and no fixed version is published.
CRLF injection in the Dnsmasq-related DNS group configuration of Oray Pugongying X5 Pro 7.6.1 can let an attacker with authenticated administrative access inject newline sequences that, per the referenced PoC, are executed as a root script, with high confidentiality, integrity, and availability impact. Exploitation requires administrative access to the DNS group feature plus user interaction, so exposure depends on whether the management interface is reachable and how well admin access is protected; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV confirmation was provided. The vendor did not respond to disclosure and no official fixed version is listed, making this a conditional risk rather than a drop-everything emergency.
Unrestricted file upload in the PPPoE WAN Setting Handler of Oray Pugongying X5 Pro 7.6.1 lets an attacker who already holds administrative access to the router management interface manipulate the pppd_options argument so that plugin_init writes attacker-controlled content to /tmp/upload_files, ultimately enabling code execution on the device. Per the vendor CVSS vector the attack is network-reachable and low-complexity but requires high privileges (PR:H), which is the main limiting factor. A public PoC reference exists (a Notion write-up describing root code execution via the PPPoE plugin option) but it is not verified as working exploit code, and the vendor was contacted about the disclosure without responding, so no patch is available. This is a genuine but lower-tier priority rather than a drop-everything emergency, though it should be handled this week.
A CRLF injection (CWE-93) in the L2TP Authentication component of the Oray Pugongying X5 Pro router running firmware 7.6.1 allows an attacker who controls the L2TP Username argument to insert carriage-return/line-feed sequences into authentication handling, which the vendor-tagged data classifies as code injection and the published reference describes as reaching root code execution. The CVSS 4.0 vector scores 8.5 (AV:N/AC:L/AT:N/PR:H/UI:N) with high confidentiality, integrity and availability impact on both the vulnerable device and subsequent systems, but exploitation requires high privileges (PR:H) - authenticated or configuration-level access to the device's L2TP setup - rather than anonymous reach. A public PoC reference exists (a Notion write-up titled for root code execution via L2TP username injection); it is not verified as working exploit code, and there is no CISA KEV listing, though the current priority decision is to remediate this week. The vendor was contacted about the disclosure and did not respond.
CRLF injection in the IPsec Policy Handler of Oray Pugongying X5 Pro 7.6.1 allows an authenticated high-privilege administrator to place unsanitized secproto values into /etc/ipsec.conf and inject additional IPsec configuration directives that execute as root. The CVSS 4.0 score is 8.5 with PR:H and no user interaction, and the independent assessment rates confidentiality, integrity and availability impact as high for both the device and downstream systems. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV entry is provided, the vendor did not respond, and no fixed version is published.