CVE-2026-116233

Summary

A CRLF injection vulnerability exists in the Dnsmasq component of Oray Pugongying X5 Pro 7.6.1, triggered by manipulation of the 'rent_time' argument, allowing remote attackers to inject control characters into DNS responses.

Exploitability

Exploitation requires high-privilege access (PR:H) and no user interaction, but the vendor's silence suggests limited patching or mitigation options are publicly known.

Blast radius

Successful exploitation could enable attackers to manipulate DNS responses, potentially leading to traffic redirection, cache poisoning, or further compromise of internal network services.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Oray Pugongying X5 Pro firmware version 7.6.2 or later — however, since the vendor did not respond to early disclosure and no fixed version is confirmed in the description, immediately restrict external access to the Dnsmasq service and disable unnecessary DNS features until a patch is verified.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.