9.9
CriticalCVSS 3.1 · from VulDB
CVE-2026-116232
Oray Pugongying X5 Pro SNMP snmp_set crlf injection
Pugongying X5 Pro · CWE-93 · CWE-93AffectedPugongying X5 Pro
FixNo fix listed yet.
PublishedOct 26, 08:00 · VulDB
ScoredOct 26 · 9.9 · VulDB
Exploit code publicNone known · checked 22:18 UTC
ExploitedNone known · CISA KEV checked 22:30 UTC
What we know
No known exploitation. CISA KEV, checked 22:30 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
From VulDB
Affected and fixed versions
ProductAffectedFixed inPugongying X5 Pro7.6.1–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known