CVE-2026-116231: Oray X5 Pro CRLF Injection

Are You Affected?

CVE-2026-116231 affects the Oray Pugongying X5 Pro router running firmware version 7.6.1. The vulnerable component is identified as ser2net, and the reported attack manipulates the regmsg argument to trigger CRLF injection.

The available record does not establish a broader affected version range, impacted hardware revisions, or whether other Oray products are vulnerable. Administrators should confirm the model and firmware version through the router’s management interface, asset inventory, or configuration-management system.

The available sources do not confirm whether the vulnerable interface is enabled by default, which interfaces expose it, or whether authentication limits exploitation. If a device cannot be positively identified or its firmware version cannot be verified, treat it as potentially affected until it is isolated or replaced.

Organizations managing broader access-control risks can also review this Kubernetes RBAC FAQ when assessing how network-device administration fits into least-privilege controls.

The Fix, If You’re in a Hurry

No vendor-confirmed fixed firmware version was identified in the available advisories and product references. There is therefore no responsible “upgrade to version X” instruction for this CVE.

The immediate priority is to remove affected routers from untrusted network exposure:

1. Block inbound Internet access to management and serial-network services.
2. Disable remote administration and unused ser2net-related functionality where supported.
3. Place the router behind a separate filtering appliance if it must remain in service.
4. Monitor vendor advisories for a verified fixed release.
5. Replace or remove any Internet-facing device that cannot be adequately filtered.

Analyst’s Take: Containment should come before firmware hunting. NVD reports a 9.9 score and a public exploit, while no vendor-fixed version has been identified. An exposed 7.6.1 device should not remain reachable while administrators wait for clearer vendor guidance.

Immediate mitigation example

Use the following only as a defensive pattern, adapting interface names and firewall tooling to your environment:

# Example Linux firewall controls for a management or upstream filtering host.
# Replace eth0 and the service port with values confirmed in your environment.
sudo iptables -A INPUT -i eth0 -m conntrack --ctstate NEW -j DROP
sudo iptables -A FORWARD -i eth0 -d <affected-router-ip> -m conntrack \
  --ctstate NEW -j DROP

Do not blindly apply these commands to a production router or gateway without validating the traffic path. The research record does not identify the vulnerable service port, so administrators should not invent a port-based rule. Review device configuration and upstream firewall logs to identify exposed services, then deny unsolicited access to those services.

If Oray publishes a fixed firmware release, upgrade using the vendor’s documented procedure and verify the resulting version afterward.

How This Vulnerability Works

The reported flaw is a CRLF injection vulnerability in an unspecified function of the X5 Pro’s ser2net component. CRLF refers to carriage-return and line-feed characters, commonly represented as \r\n. These characters have structural meaning in many text-based protocols. If an application fails to validate or encode them correctly, attacker-controlled input may be interpreted as additional headers, records, lines, or commands.

The vulnerable input is the regmsg argument. According to the NVD description, manipulating that argument causes CRLF injection and can be performed remotely. The available record does not establish the complete exploitation chain. It does not confirm whether the flaw enables arbitrary file writes, command execution, authentication bypass, denial of service, or another specific impact.

The disclosure reference’s title suggests a relationship between the X5 Pro serial banner, newline processing, ser2net, and overwriting existing files. That title is not sufficient to independently verify the exact payload or impact because the underlying technical material was not available in retrievable detail. Defenders should therefore treat the issue as a high-risk remote input-validation flaw without assuming a particular post-exploitation outcome.

What to look for in requests

A conceptual malicious request may contain encoded carriage-return and line-feed characters, such as %0d%0a, in or near the regmsg parameter:

GET /<service-path>?regmsg=<value>%0d%0a<additional-data> HTTP/1.1

The exact path, protocol, port, and payload are not established by the available sources. Do not use this example as a complete exploit or validated network signature. Its purpose is to show indicators that may be searched for in HTTP, proxy, gateway, and device logs.

Severity Explained

NVD assigns CVE-2026-116231 a CVSS base score of 9.9, placing it in the critical severity range. The score indicates that the vulnerability is considered highly serious under the associated scoring assessment.

The retrieved NVD API result did not include a CVSS vector string, and the vector could not be independently verified from the available sources. The precise values for attack complexity, privileges required, user interaction, scope, confidentiality, integrity, and availability must therefore not be inferred.

The record establishes remote exploitability but does not safely support claims such as “no authentication is required” or “the flaw provides remote code execution.”

For operational prioritization, the combination of a 9.9 score, remote reachability, public exploit availability, and the absence of a known vendor fix warrants immediate containment. CISA KEV status should not be confused with severity: the CVE is not currently in the KEV catalog, but that does not make Internet exposure acceptable.

Is It Being Exploited?

The NVD description explicitly states that an exploit has been publicly released. Technical exploitation material is therefore available to at least some threat actors, although the available research did not verify a specific GitHub repository or exploit package.

Confirmed active exploitation in the wild has not been established from the available sources. CVE-2026-116231 is not listed in the CISA Known Exploited Vulnerabilities catalog, and no vendor-confirmed exploitation campaign or ransomware connection was identified.

The absence of KEV inclusion does not prove that exploitation is impossible or absent. It means only that CISA had not listed the CVE at the time of review.

The current evidence can be summarized as follows:

• Public exploit: Yes, according to NVD.
• Verified public GitHub proof-of-concept repository: Not identified.
• Confirmed exploitation in the wild: Not established.
• CISA KEV listing: No.
• Vendor-confirmed campaign: None identified.

Organizations should prioritize exposed devices because public exploit availability reduces the time an attacker may need to develop or adapt an attack.