CVE-2026-116232

Summary

A CRLF injection vulnerability exists in the SNMP handler component of Oray Pugongying X5 Pro 7.6.1, where unsanitized input to the snmp_set function's info.community argument allows attackers to inject carriage return and line feed characters, potentially enabling command injection or log manipulation.

Exploitability

Exploitation requires low-privilege network access (PR:L) with no user interaction; however, successful exploitation likely depends on additional application-specific parsing behavior not detailed in the public description.

Blast radius

Successful exploitation could lead to full system compromise (C:H/I:H/A:H) via command execution or log tampering, especially given the device's typical deployment in critical infrastructure or network monitoring roles.

Detection

Monitor SNMP traffic for requests containing unexpected CRLF sequences (e.g., %0d%0a or literal ) in the community string field; look for anomalous log entries with embedded newlines or unexpected SNMP SET commands targeting non-standard community strings.

Prioritized remediation

Upgrade to a patched firmware version if one is available; since the vendor did not respond and no fixed version is published, immediately disable SNMP functionality or restrict SNMP access to trusted management networks via ACLs.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.