CVE-2026-116231 in Pugongying X5 Pro
Summary
by MITRE • 10/26/2026
A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
A critical security vulnerability has been identified within Oray Pugongying X5 Pro version 7.6.1, specifically affecting a function associated with the Ser2net component. This device is widely used for remote serial-to-network bridging, allowing users to access legacy hardware over IP networks. The core technical flaw involves improper input validation and sanitization of the regmsg argument passed during communication processes. Due to this deficiency, an attacker can inject Carriage Return (CR) and Line Feed (LF) characters into the command stream. This type of vulnerability is classified under CWE-13 as CRLF Injection, a category of injection flaws where malicious data containing control characters is inserted into input fields or headers. In the context of Ser2net, which manages serial port connections over TCP/IP, such injection can disrupt session integrity and potentially allow for command execution if the injected content interacts with underlying shell commands or configuration parsers that are not strictly isolated from user-supplied input.
The operational impact of this vulnerability is severe due to its remote exploitability. An attacker does not need physical access to the device nor valid authentication credentials in many configurations, as Ser2net often operates on default ports like 4001 with minimal or no security controls enabled by default. By leveraging CRLF injection through the regmsg parameter, an adversary can manipulate the communication protocol layer. This may lead to session hijacking, where the attacker takes control of an existing serial connection, or it could facilitate further attacks such as cross-site scripting if web interfaces are involved in managing these connections. Furthermore, because Ser2net acts as a bridge between network traffic and physical serial devices like routers, switches, or industrial controllers, compromising this component effectively grants the attacker indirect access to those critical infrastructure elements. The availability of public exploits significantly lowers the barrier for entry, enabling less sophisticated threat actors to compromise vulnerable systems on a large scale.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse or Protocol Manipulation. Attackers can use CRLF injection to split HTTP headers if web management interfaces are present, potentially leading to header injection attacks that alter the behavior of downstream proxies or load balancers. In pure serial-over-IP scenarios, it may allow for unauthorized command insertion into the data stream destined for connected devices. The lack of vendor response since early disclosure indicates a significant gap in security maintenance and incident handling processes by Oray. This silence leaves users exposed to ongoing exploitation without official patches or guidance on mitigation strategies from the manufacturer.
To mitigate this risk, immediate remediation steps are required for administrators utilizing affected firmware versions. Since no patch has been provided, network-level isolation is the most effective defense. Administrators should ensure that Ser2net services are not accessible from untrusted networks such as the public internet. If remote access is necessary, it must be restricted to specific trusted IP addresses using firewall rules or Access Control Lists (ACLs). Additionally, enabling authentication mechanisms within Ser2net configuration files can prevent unauthorized users from interacting with the service at all. For environments where upgrading firmware is not immediately possible, deploying a Web Application Firewall (WAF) or intrusion prevention system (IPS) capable of detecting and blocking CRLF injection patterns in network traffic can provide an additional layer of defense. Long-term resolution requires monitoring for vendor updates and considering migration to more secure alternatives that enforce strict input validation and follow security best practices by design.