CVE-2026-116235
Oray Pugongying X5 Pro L2TP Authentication crlf injection
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
Oray Pugongying X5 Pro software is affected through its L2TP authentication feature. A remote attacker can insert line-break characters into the username field, which could let them alter how the software processes login data.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected versions
- Oray Pugongying X5 Pro
7.6.1