---
id: CVE-2026-116235
title: Oray Pugongying X5 Pro L2TP Authentication crlf injection
summary: >-
  A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this
  vulnerability is an unknown functionality of the component L2TP
  Authentication. This manipulation of the argument Username causes crlf
  injection. The attack may be i…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'
cvssSource: cna
cwe:
  - CWE-93
  - CWE-74
vendor: Oray
product: Pugongying X5 Pro
affected:
  - pugongying_x5_pro 7.6.1
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T08:45:16.165Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116235'
references:
  - url: 'https://vuldb.com/vuln/426284'
    label: VDB-426284 | Oray Pugongying X5 Pro L2TP Authentication crlf injection
  - url: 'https://vuldb.com/vuln/426284/cti'
    label: 'VDB-426284 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-116235'
    label: CVE-2026-116235 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1005083'
    label: >-
      Submit #1005083 | Oray  Pgyer X5 Pro Router 7.6.1 Improper Neutralization
      of CRLF Sequences ('CRLF Injection')
  - url: >-
      https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Root-Code-Execution-via-L2TP-Username-Injection-3ea797159f158012be0af2ca84d1ee2b
tags:
  - cve.org
ingestedAt: '2026-10-26T09:22:35.521Z'
---

## Overview

A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Affected

- `pugongying_x5_pro 7.6.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.