8.4
HighCVSS 3.1 · from VulDB
CVE-2026-116237
Oray Pugongying X5 Pro Dnsmasq crlf injection
Pugongying X5 Pro · CWE-93 · CWE-93AffectedPugongying X5 Pro
FixNo fix listed yet.
PublishedOct 26, 09:15 · VulDB
ScoredOct 26 · 8.4 · VulDB
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
From VulDB
Affected and fixed versions
ProductAffectedFixed inPugongying X5 Pro7.6.1–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known