Soumettre #1005085: Oray Pgyer X5 Pro Router 7.6.1 Improper Neutralization of CRLF Sequences ('CRLF Injection')
| Titre | Oray Pgyer X5 Pro Router 7.6.1 Improper Neutralization of CRLF Sequences ('CRLF Injection') |
|---|---|
| Description | Oray Pgyer X5 Pro Router firmware 7.6.1 accepts newlines in DNS group members and writes them into the dnsmasq configuration without escaping, allowing a user with the management system password to inject a dhcp-script directive and run a script as root when dnsmasq processes a DHCP lease. |
| La source | ⚠️ https:/ |
| Utilisateur | FirmHarness (UID 99865) |
| Soumission | 29/09/2026 14:11 (il y a 1 mois) |
| Modérer | 25/10/2026 16:21 (26 days later) |
| Statut | Accepté |
| Entrée VulDB | 426286 [Oray Pugongying X5 Pro 7.6.1 Dnsmasq élévation de privilèges] |
| Points | 17 |