CVE-2026-116234

Summary

A CRLF injection vulnerability exists in the IPsec policy handler of Oray Pugongying X5 Pro 7.6.1, where unsanitized input to the 'secproto' argument in /etc/ipsec.conf allows attackers to inject control characters and potentially manipulate policy configuration.

Exploitability

Exploitation requires high-privilege access (PR:H) and remote attack capability (AV:N, AC:L), meaning the attacker must already hold elevated credentials on the system or compromise such an account.

Blast radius

Successful exploitation could lead to full compromise of confidentiality, integrity, and availability due to the CVSS impact metrics (C:H/I:H/A:H) and scope change (S:C), potentially enabling policy manipulation that affects downstream network security controls.

Detection

Monitor for unexpected modifications to /etc/ipsec.conf containing CRLF sequences (e.g., %0d%0a or literal ) in the 'secproto' parameter, especially when accessed remotely by high-privilege accounts; inspect system logs for unusual IPsec configuration reload events coinciding with such file changes.

Prioritized remediation

Upgrade to a patched firmware version from Oray; since no fixed version is specified in the description and the vendor did not respond, disable IPsec functionality or restrict access to /etc/ipsec.conf via file permissions and network segmentation until a patch is available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.