Critical CRLF Injection Vulnerability in Oray Pugongying X5 Pro

Executive Summary

A critical vulnerability (CVE-2026-116232) has been identified in Oray Pugongying X5 Pro 7.6.1, affecting the SNMP Handler component. This vulnerability allows for CRLF injection via manipulation of the info.community argument, enabling remote attacks. The vulnerability has a CVSS score of 9.9 and is considered critical.

Technical Analysis

The vulnerability is classified as a CRLF (Carriage Return Line Feed) injection vulnerability. It affects the SNMP Handler component of Oray Pugongying X5 Pro 7.6.1. The root cause of this vulnerability is the lack of proper input validation in the snmp_set function, specifically with the info.community argument. An attacker can exploit this vulnerability remotely by manipulating the info.community argument to inject malicious CRLF sequences.

How It Gets Exploited

An unauthenticated remote attacker can exploit this vulnerability by sending a crafted SNMP request to the vulnerable Oray Pugongying X5 Pro device. Specifically, the attacker would manipulate the info.community argument in the SNMP request to inject CRLF sequences. This could potentially allow the attacker to execute arbitrary commands or inject malicious data. The attack vector involves sending a specially crafted request to the SNMP Handler, which fails to properly validate the input, leading to the injection of malicious CRLF sequences.

Impact Assessment

The vulnerability affects Oray Pugongying X5 Pro version 7.6.1. Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution, data injection, or other malicious activities. The CVSS score of 9.9 indicates a critical severity level, with high impacts on confidentiality, integrity, and availability.

Recommended Actions

To mitigate this vulnerability, it is recommended to update Oray Pugongying X5 Pro to a version that is not vulnerable, if available. In the absence of a patch, consider implementing network segmentation to isolate vulnerable devices, and monitor SNMP traffic for suspicious activity. Additionally, restrict access to the SNMP interface to only trusted networks and hosts.

Sources

- National Vulnerability Database (NVD) - Vuldb.com