Skip to content
Threat Feed
Subscribe
critical advisory

Oray Pugongying X5 Pro: CRLF injection in Ser2net (CVE-2026-116231)

A security flaw in the Ser2net component of Oray Pugongying X5 Pro 7.6.1 allows for remote CRLF injection via manipulation of the regmsg argument.

CVE search metadata

CVE search record: CVE-2026-116231. Severity: critical. CVSS: 9.9. KEV: no. Product: Oray Pugongying X5 Pro 7.6.1, Pugongying X5 Pro (7.6.1). Brief: Oray Pugongying X5 Pro: CRLF injection in Ser2net (CVE-2026-116231). Brief link: https://feed.craftedsignal.io/briefs/2026-10-oray-x5-pro-crlf/

CVE search record: CVE-2026-116233. Severity: critical. CVSS: 9.1. KEV: no. Product: Oray Pugongying X5 Pro 7.6.1, Pugongying X5 Pro (7.6.1). Brief: Oray Pugongying X5 Pro: CRLF injection in Ser2net (CVE-2026-116231). Brief link: https://feed.craftedsignal.io/briefs/2026-10-oray-x5-pro-crlf/

CVE search record: CVE-2026-116234. Severity: critical. CVSS: 9.1. KEV: no. Product: Oray Pugongying X5 Pro 7.6.1, Pugongying X5 Pro (7.6.1). Brief: Oray Pugongying X5 Pro: CRLF injection in Ser2net (CVE-2026-116231). Brief link: https://feed.craftedsignal.io/briefs/2026-10-oray-x5-pro-crlf/

Triage facts

Revision 1
Applicability
Oray Pugongying X5 Pro 7.6.1, Pugongying X5 Pro (7.6.1)
Evidence
Unknown
Severity
Critical
Sources
3 public sources
Freshness
Revision 1Oct 26, 09:40 UTC
Vulnerabilities
3 CVEs
Source quality
A2Roughly even chance

What's new

  • 1. added CVE-2026-116233, CVE-2026-116234 Oct 26, 09:40 via nvd, source

A security flaw has been identified in the Ser2net component of Oray Pugongying X5 Pro 7.6.1. Manipulation of the 'regmsg' argument results in CRLF injection. The attack can be initiated remotely. Public exploit code is available for this vulnerability. The vendor was contacted but did not respond.