CVE-2026-116234 Oray CVE debrief

Who should care

Defenders responsible for Oray Pugongying X5 Pro 7.6.1 devices should assess exposure and prioritize verification of IPsec Policy Handler configurations. Defenders should prioritize verifying exposure of Oray Pugongying X5 Pro 7.6.1 devices to crlf injection attacks via IPsec Policy Handler. The exploit is public and may be used.

Why it matters

Defenders should prioritize verifying exposure of Oray Pugongying X5 Pro 7.6.1 devices to crlf injection attacks via IPsec Policy Handler. The exploit is public and may be used.

• Verify exposure of Oray Pugongying X5 Pro 7.6.1 devices to crlf injection attacks
• Monitor for public exploit usage
• Review and update IPsec Policy Handler configurations

Technical summary

The vulnerability affects Oray Pugongying X5 Pro 7.6.1 and involves an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and may be used. Defenders should prioritize verifying exposure of Oray Pugongying X5 Pro 7.6.1 devices to crlf injection attacks via IPsec Policy Handler. Limited source detail is available, so defenders should exercise caution and verify information through additional means.

Defensive priority

Defenders should prioritize verifying exposure of Oray Pugongying X5 Pro 7.6.1 devices to crlf injection attacks via IPsec Policy Handler.

Recommended defensive actions

• Verify Oray Pugongying X5 Pro 7.6.1 devices for exposure to crlf injection attacks via IPsec Policy Handler
• Monitor for public exploit usage
• Review and update IPsec Policy Handler configurations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The vendor was contacted but did not respond. Defenders should verify exposure of Oray Pugongying X5 Pro 7.6.1 devices to crlf injection attacks via IPsec Policy Handler. The exploit is public and may be used. Limited source detail is available, so defenders should exercise caution and verify information through additional means.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.