# CVE-2026-116234: Oray Pugongying X5 Pro CRLF injection in IPsec policy handler

Source: https://junglewise.ai/threats/cve-2026-116234-a-vulnerability-was-detected-in-oray-pugongying-x5-pro-7-6-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-116234 · Severity: critical · CVSS 9.1 · Published 2026-10-26

Oray Pugongying X5 Pro is a network appliance that manages IPsec VPN policies. A CRLF injection vulnerability in the IPsec policy configuration allows remote attackers to manipulate firewall rules and potentially execute code or disable security controls without authentication.

Technologies: [Oray Pugongying X5 Pro](https://junglewise.ai/threats/technologies/pugongying-x5-pro). Vendors: [Oray](https://junglewise.ai/threats/vendors/oray).

## Quick answers

**Is CVE-2026-116234 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116234 being exploited in the wild.

**How severe is CVE-2026-116234?** Critical severity, with a CVSS score of 9.1, published 26 October 2026.

**Which products and versions are affected?** Oray Pugongying X5 Pro 7.6.1.

**Is there a fix for CVE-2026-116234?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-116234 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116234?** Check whether you run Oray Pugongying X5 Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A CRLF injection vulnerability exists in the IPsec Policy Handler component of Oray Pugongying X5 Pro 7.6.1, specifically in the handling of the secproto parameter in /etc/ipsec.conf. The vulnerability allows remote unauthenticated attackers to inject arbitrary CRLF sequences, leading to policy misconfiguration and potential command execution. A public exploit exists for this vulnerability.

## Affected products

- Oray Pugongying X5 Pro 7.6.1

## Timeline

- 2026-10-26: disclosed

## References

- [https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Root-Code-Execution-via-IPsec-secproto-Injection-3ea797159f1580919c5dea13e5baea84](https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Root-Code-Execution-via-IPsec-secproto-Injection-3ea797159f1580919c5dea13e5baea84)
- [https://vuldb.com/cve/CVE-2026-116234](https://vuldb.com/cve/CVE-2026-116234)

## Related threats

- [Oray Pugongying X5 Pro path traversal in config_restore_ex](https://junglewise.ai/threats/cve-2026-120225-a-weakness-has-been-identified-in-oray-pugongying-x5-pro-up-to-7)
- [Oray Pugongying X5 Pro API authorization bypass](https://junglewise.ai/threats/cve-2026-120224-a-security-flaw-has-been-discovered-in-oray-pugongying-x5-pro-up)
- [Oray Pugongying X5 Pro CRLF injection in Dnsmasq](https://junglewise.ai/threats/cve-2026-116237-a-vulnerability-was-found-in-oray-pugongying-x5-pro-7-6-1-this)
- [Oray Pugongying X5 Pro unrestricted file upload in PPPoE handler](https://junglewise.ai/threats/cve-2026-116236-a-vulnerability-has-been-found-in-oray-pugongying-x5-pro-7-6-1)
- [Oray Pugongying X5 Pro CRLF injection in L2TP authentication](https://junglewise.ai/threats/cve-2026-116235-a-flaw-has-been-found-in-oray-pugongying-x5-pro-7-6-1-affected)