CVE-2026-116235: Oray Pugongying X5 Pro L2TP Authentication crlf injection
A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are known to be affected?
The affected product and version identified are Oray Pugongying X5 Pro 7.6.1, specifically its L2TP Authentication component. The available information does not state whether other versions or configurations are affected.
What does an attacker need to exploit this issue?
The attack can be initiated remotely and involves manipulating the Username argument in L2TP Authentication. The vector indicates low attack complexity, no user interaction, and high privileges required.
Is public exploit code available?
Yes. The vulnerability information states that an exploit has been published and may be used.
What should teams do if a patch is not available?
The provided information does not identify a vendor fix or workaround, and states that the vendor did not respond to early disclosure contact. Prioritize restricting remote exposure to the affected L2TP Authentication interface and limiting access to trusted administrative users where operationally possible.