Pugongying X5 Pro
Monthly
CRLF injection in the Dnsmasq-related DNS group configuration of Oray Pugongying X5 Pro 7.6.1 can let an attacker with authenticated administrative access inject newline sequences that, per the referenced PoC, are executed as a root script, with high confidentiality, integrity, and availability impact. Exploitation requires administrative access to the DNS group feature plus user interaction, so exposure depends on whether the management interface is reachable and how well admin access is protected; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV confirmation was provided. The vendor did not respond to disclosure and no official fixed version is listed, making this a conditional risk rather than a drop-everything emergency.
Unrestricted file upload in the PPPoE WAN Setting Handler of Oray Pugongying X5 Pro 7.6.1 lets an attacker who already holds administrative access to the router management interface manipulate the pppd_options argument so that plugin_init writes attacker-controlled content to /tmp/upload_files, ultimately enabling code execution on the device. Per the vendor CVSS vector the attack is network-reachable and low-complexity but requires high privileges (PR:H), which is the main limiting factor. A public PoC reference exists (a Notion write-up describing root code execution via the PPPoE plugin option) but it is not verified as working exploit code, and the vendor was contacted about the disclosure without responding, so no patch is available. This is a genuine but lower-tier priority rather than a drop-everything emergency, though it should be handled this week.
A CRLF injection (CWE-93) in the L2TP Authentication component of the Oray Pugongying X5 Pro router running firmware 7.6.1 allows an attacker who controls the L2TP Username argument to insert carriage-return/line-feed sequences into authentication handling, which the vendor-tagged data classifies as code injection and the published reference describes as reaching root code execution. The CVSS 4.0 vector scores 8.5 (AV:N/AC:L/AT:N/PR:H/UI:N) with high confidentiality, integrity and availability impact on both the vulnerable device and subsequent systems, but exploitation requires high privileges (PR:H) - authenticated or configuration-level access to the device's L2TP setup - rather than anonymous reach. A public PoC reference exists (a Notion write-up titled for root code execution via L2TP username injection); it is not verified as working exploit code, and there is no CISA KEV listing, though the current priority decision is to remediate this week. The vendor was contacted about the disclosure and did not respond.
CRLF injection in the IPsec Policy Handler of Oray Pugongying X5 Pro 7.6.1 allows an authenticated high-privilege administrator to place unsanitized secproto values into /etc/ipsec.conf and inject additional IPsec configuration directives that execute as root. The CVSS 4.0 score is 8.5 with PR:H and no user interaction, and the independent assessment rates confidentiality, integrity and availability impact as high for both the device and downstream systems. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV entry is provided, the vendor did not respond, and no fixed version is published.
CRLF injection in the Dnsmasq configuration path of Oray Pugongying X5 Pro 7.6.1 lets a user who already holds administrative access to the router's management interface inject newline-delimited Dnsmasq directives through the DHCP lease-time (rent_time) parameter, corrupting the device's DNS/DHCP behaviour and enabling configuration tampering and potential information disclosure. Exploitation is remote over the network with no user interaction, but the CVSS vector carries PR:H - an attacker must first obtain admin credentials, which is the primary limiting factor, so this is not reachable by an unauthenticated outsider. A public PoC reference (a Notion write-up titled 'Dnsmasq Directive Injection Through DHCP Lease Time') exists but is not verified as working exploit code; the vendor was contacted and did not respond, so no fixed version is available, and the disclosure is tracked for remediation this week.
CRLF injection in the SNMP Handler of Oray Pugongying X5 Pro 7.6.1 lets a low-privileged authenticated user inject newline sequences through the info.community argument handled by snmp_set, potentially causing the root-running snmpd to execute commands as root. The issue is network reachable, requires authentication (CVSS 4.0 score 8.6, PR:L), and affects both the router and subsequent systems; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV active exploitation is reported. The vendor was contacted early about the disclosure and did not respond, and no vendor-released patch is identified at time of analysis.
CRLF injection in the ser2net serial-handling component of Oray Pugongying X5 Pro 7.6.1 lets a network-positioned attacker with low-level privileges manipulate the regmsg argument so that an unescaped newline sequence in a serial banner overwrites an existing file on the device. The vendor-supplied CVSS 4.0 score is 8.6 (High); the independently assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H, reflecting high integrity and availability impact with lower confidentiality impact, and requiring PR:L - the attacker must already hold a low-privilege foothold/authentication on the device rather than being fully unauthenticated. No CISA KEV entry exists and no EPSS value was supplied; a public PoC reference exists, but it is not verified as working exploit code. The vendor was contacted and did not respond, so no official fix or vendor-stated mitigation is documented.
CRLF injection in the Dnsmasq-related DNS group configuration of Oray Pugongying X5 Pro 7.6.1 can let an attacker with authenticated administrative access inject newline sequences that, per the referenced PoC, are executed as a root script, with high confidentiality, integrity, and availability impact. Exploitation requires administrative access to the DNS group feature plus user interaction, so exposure depends on whether the management interface is reachable and how well admin access is protected; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV confirmation was provided. The vendor did not respond to disclosure and no official fixed version is listed, making this a conditional risk rather than a drop-everything emergency.
Unrestricted file upload in the PPPoE WAN Setting Handler of Oray Pugongying X5 Pro 7.6.1 lets an attacker who already holds administrative access to the router management interface manipulate the pppd_options argument so that plugin_init writes attacker-controlled content to /tmp/upload_files, ultimately enabling code execution on the device. Per the vendor CVSS vector the attack is network-reachable and low-complexity but requires high privileges (PR:H), which is the main limiting factor. A public PoC reference exists (a Notion write-up describing root code execution via the PPPoE plugin option) but it is not verified as working exploit code, and the vendor was contacted about the disclosure without responding, so no patch is available. This is a genuine but lower-tier priority rather than a drop-everything emergency, though it should be handled this week.
A CRLF injection (CWE-93) in the L2TP Authentication component of the Oray Pugongying X5 Pro router running firmware 7.6.1 allows an attacker who controls the L2TP Username argument to insert carriage-return/line-feed sequences into authentication handling, which the vendor-tagged data classifies as code injection and the published reference describes as reaching root code execution. The CVSS 4.0 vector scores 8.5 (AV:N/AC:L/AT:N/PR:H/UI:N) with high confidentiality, integrity and availability impact on both the vulnerable device and subsequent systems, but exploitation requires high privileges (PR:H) - authenticated or configuration-level access to the device's L2TP setup - rather than anonymous reach. A public PoC reference exists (a Notion write-up titled for root code execution via L2TP username injection); it is not verified as working exploit code, and there is no CISA KEV listing, though the current priority decision is to remediate this week. The vendor was contacted about the disclosure and did not respond.
CRLF injection in the IPsec Policy Handler of Oray Pugongying X5 Pro 7.6.1 allows an authenticated high-privilege administrator to place unsanitized secproto values into /etc/ipsec.conf and inject additional IPsec configuration directives that execute as root. The CVSS 4.0 score is 8.5 with PR:H and no user interaction, and the independent assessment rates confidentiality, integrity and availability impact as high for both the device and downstream systems. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV entry is provided, the vendor did not respond, and no fixed version is published.
CRLF injection in the Dnsmasq configuration path of Oray Pugongying X5 Pro 7.6.1 lets a user who already holds administrative access to the router's management interface inject newline-delimited Dnsmasq directives through the DHCP lease-time (rent_time) parameter, corrupting the device's DNS/DHCP behaviour and enabling configuration tampering and potential information disclosure. Exploitation is remote over the network with no user interaction, but the CVSS vector carries PR:H - an attacker must first obtain admin credentials, which is the primary limiting factor, so this is not reachable by an unauthenticated outsider. A public PoC reference (a Notion write-up titled 'Dnsmasq Directive Injection Through DHCP Lease Time') exists but is not verified as working exploit code; the vendor was contacted and did not respond, so no fixed version is available, and the disclosure is tracked for remediation this week.
CRLF injection in the SNMP Handler of Oray Pugongying X5 Pro 7.6.1 lets a low-privileged authenticated user inject newline sequences through the info.community argument handled by snmp_set, potentially causing the root-running snmpd to execute commands as root. The issue is network reachable, requires authentication (CVSS 4.0 score 8.6, PR:L), and affects both the router and subsequent systems; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV active exploitation is reported. The vendor was contacted early about the disclosure and did not respond, and no vendor-released patch is identified at time of analysis.
CRLF injection in the ser2net serial-handling component of Oray Pugongying X5 Pro 7.6.1 lets a network-positioned attacker with low-level privileges manipulate the regmsg argument so that an unescaped newline sequence in a serial banner overwrites an existing file on the device. The vendor-supplied CVSS 4.0 score is 8.6 (High); the independently assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H, reflecting high integrity and availability impact with lower confidentiality impact, and requiring PR:L - the attacker must already hold a low-privilege foothold/authentication on the device rather than being fully unauthenticated. No CISA KEV entry exists and no EPSS value was supplied; a public PoC reference exists, but it is not verified as working exploit code. The vendor was contacted and did not respond, so no official fix or vendor-stated mitigation is documented.