Critical CRLF Injection Vulnerability in Oray Pugongying X5 Pro
A critical CRLF injection vulnerability (CVE-2026-116231) has been discovered in Oray Pugongying X5 Pro 7.6.1, specifically in the Ser2net component. This vulnerability allows remote attackers to inject malicious CRLF sequences, potentially leading to severe impacts including confidentiality, integrity, and availability compromise. The vulnerability has a CVSS score of 9.9 and is considered critical. Although not actively exploited, the exploit has been released publicly, increasing the risk of attacks. Immediate patching or mitigation is recommended.