Executive Summary
CVE-2026-116235 is a CRLF injection vulnerability in the L2TP Authentication component of Oray Pugongying X5 Pro 7.6.1. Manipulating the Username argument allows injected carriage-return and line-feed characters. The attack may be initiated remotely and a public exploit has been published. No fixed version is reported.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-116235 |
| CVSS 3.1 | 9.1 (Critical) |
| Type | CRLF Injection |
| Component | L2TP Authentication, Username argument |
| Attack Vector | Network |
| Exploit Available | Yes (public) |
| Known Exploited | Not reported |
| Patch Available | No vendor response reported |
Affected Products
| Product | Version | Status |
|---|---|---|
| Oray Pugongying X5 Pro | 7.6.1 | Vulnerable, no fix reported |
Impact
Injected line breaks in a username that flows into authentication or VPN configuration files can add unintended entries, such as extra credentials or altered options. Exact impact depends on how the device writes and parses these values.
Related Vulnerabilities
- CVE-2026-116233 — Dnsmasq
rent_time - CVE-2026-116234 — IPsec Policy Handler
secproto
Mitigation
- Do not expose the L2TP service or management interface to untrusted networks.
- Review VPN user lists and L2TP configuration for unexpected accounts or options.
- Rotate VPN credentials if tampering is suspected.
- Monitor the vendor and VulDB for a fix; plan to replace the device if none is issued.