Executive Summary
CVE-2026-116233 is a CRLF injection vulnerability in the Dnsmasq component of Oray Pugongying X5 Pro 7.6.1. Manipulating the rent_time argument lets an attacker inject carriage-return and line-feed sequences into generated configuration. The attack can be launched remotely and a public exploit has been disclosed. The vendor was contacted early and did not respond, and no fixed version is reported.
This is one of several sibling CRLF injection flaws published against the same product and version on October 26, 2026.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-116233 |
| CVSS 3.1 | 9.1 (Critical) |
| CVSS 4.0 (VulDB) | 9.4 |
| Type | CRLF Injection (CWE-74, CWE-93) |
| Component | Dnsmasq, rent_time argument |
| Attack Vector | Network |
| Privileges Required | High |
| Exploit Available | Yes (public) |
| Known Exploited | Not reported |
| Patch Available | No vendor response |
Both scores assume an attacker with high privileges on the device. Some commentary describes the issue as remote code execution; the official description only says CRLF injection, so treat that claim as unconfirmed.
Affected Products
| Product | Version | Status |
|---|---|---|
| Oray Pugongying X5 Pro | 7.6.1 | Vulnerable, no fix reported |
Related Vulnerabilities
| CVE | Component |
|---|---|
| CVE-2026-116234 | IPsec Policy Handler (secproto) |
| CVE-2026-116235 | L2TP Authentication (Username) |
| CVE-2026-116231 | Ser2net |
| CVE-2026-116232 | SNMP Handler |
| CVE-2026-116237 | Dnsmasq |
Mitigation
- Do not expose the device management interface to the internet or untrusted networks.
- Restrict administrative access to a dedicated management VLAN and trusted hosts, and use strong, unique admin credentials, since exploitation needs elevated privileges.
- Review DHCP and DNS settings for unexpected values, especially lease time fields containing unusual characters.
- Monitor the vendor and VulDB entry for a patched release, and consider replacing the device if none is issued.