{"id":"CVE-2026-116234","published":"2026-10-26T09:16:34.953","lastModified":"2026-10-26T13:41:11.497","description":"A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-74","CWE-93"],"vendors":[],"products":[],"references":[{"url":"https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Root-Code-Execution-via-IPsec-secproto-Injection-3ea797159f1580919c5dea13e5baea84","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-116234","tags":[]},{"url":"https://vuldb.com/submit/1005082","tags":[]},{"url":"https://vuldb.com/vuln/426283","tags":[]},{"url":"https://vuldb.com/vuln/426283/cti","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A CRLF injection vulnerability exists in the IPsec policy handler of Oray Pugongying X5 Pro 7.6.1, where unsanitized input to the 'secproto' argument in /etc/ipsec.conf allows attackers to inject control characters and potentially manipulate policy configuration.","exploitability":"Exploitation requires high-privilege access (PR:H) and remote attack capability (AV:N, AC:L), meaning the attacker must already hold elevated credentials on the system or compromise such an account.","blast_radius":"Successful exploitation could lead to full compromise of confidentiality, integrity, and availability due to the CVSS impact metrics (C:H/I:H/A:H) and scope change (S:C), potentially enabling policy manipulation that affects downstream network security controls.","remediation":"Upgrade to a patched firmware version from Oray; since no fixed version is specified in the description and the vendor did not respond, disable IPsec functionality or restrict access to /etc/ipsec.conf via file permissions and network segmentation until a patch is available.","detection":"Monitor for unexpected modifications to /etc/ipsec.conf containing CRLF sequences (e.g., %0d%0a or literal \r\n) in the 'secproto' parameter, especially when accessed remotely by high-privilege accounts; inspect system logs for unusual IPsec configuration reload events coinciding with such file changes.","tags":["crlf-injection","ipsec","privilege-escalation","policy-manipulation","network-security"],"model":"garnet-coder","analyzedAt":"2026-10-27T08:49:42.875Z"}}