{"id":"CVE-2026-116232","published":"2026-10-26T08:17:17.837","lastModified":"2026-10-26T17:17:24.717","description":"A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-74","CWE-93"],"vendors":[],"products":[],"references":[{"url":"https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-A-Community-Newline-Makes-snmpd-Run-Commands-as-Root-3ea797159f1580f3bae8c6e7d8b91d1f","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-116232","tags":[]},{"url":"https://vuldb.com/submit/1005079","tags":[]},{"url":"https://vuldb.com/vuln/426281","tags":[]},{"url":"https://vuldb.com/vuln/426281/cti","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A CRLF injection vulnerability exists in the SNMP handler component of Oray Pugongying X5 Pro 7.6.1, where unsanitized input to the snmp_set function's info.community argument allows attackers to inject carriage return and line feed characters, potentially enabling command injection or log manipulation.","exploitability":"Exploitation requires low-privilege network access (PR:L) with no user interaction; however, successful exploitation likely depends on additional application-specific parsing behavior not detailed in the public description.","blast_radius":"Successful exploitation could lead to full system compromise (C:H/I:H/A:H) via command execution or log tampering, especially given the device's typical deployment in critical infrastructure or network monitoring roles.","remediation":"Upgrade to a patched firmware version if one is available; since the vendor did not respond and no fixed version is published, immediately disable SNMP functionality or restrict SNMP access to trusted management networks via ACLs.","detection":"Monitor SNMP traffic for requests containing unexpected CRLF sequences (e.g., %0d%0a or literal \r\n) in the community string field; look for anomalous log entries with embedded newlines or unexpected SNMP SET commands targeting non-standard community strings.","tags":["crlf-injection","snmp","ics","firmware","log-tampering"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:43:08.632Z"}}