CVE-2026-116233: Critical CRLF Injection in Oray Pugongying X5 Pro — Detection and Remediation Guide

In early 2026, the National Vulnerability Database (NVD) published CVE-2026-116233, a critical-severity vulnerability with a CVSS score of 9.1, affecting the Oray Pugongying X5 Pro firmware version 7.6.1. This flaw resides in the embedded dnsmasq component — a widely used lightweight DNS forwarder and DHCP server — and stems from improper sanitization of the rent_time argument, enabling CRLF injection remotely over the network.

Given dnsmasq’s pervasive deployment across IoT devices, small office/home office (SOHO) routers, and industrial control systems, this vulnerability poses a systemic risk. The vendor, Oray, was notified early in the disclosure process but failed to respond, leaving users exposed. Public proof-of-concept (PoC) code is now circulating, raising the likelihood of active exploitation.

This post provides a technical breakdown of the vulnerability, actionable detection strategies using Sigma, KQL, and VQL, and remediation guidance for defenders.

Technical Analysis

Affected Products

• Product: Oray Pugongying X5 Pro
• Firmware Version: 7.6.1
• Component: dnsmasq (integrated DNS/DHCP service)
• Platform: Linux-based embedded systems (routers, gateways, IoT hubs)

Vulnerability Overview

• CVE ID: CVE-2026-116233
• CVSS v3.1 Score: 9.1 (Critical)
• Vector: NETWORK
• Attack Complexity: LOW
• Privileges Required: NONE
• User Interaction: NONE
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH

Root Cause: CRLF Injection via rent_time Parameter

The vulnerability exists in the web management interface’s handling of the rent_time parameter, which is passed directly to the dnsmasq configuration without proper input validation. When an attacker submits a malicious value containing carriage return and line feed (\r\n) sequences, they can inject arbitrary configuration directives into dnsmasq’s runtime configuration file.

For example, a crafted HTTP request like:

POST /apply_dhcp.cgi HTTP/1.1
Host: 192.168.1.1
Content-Type: application/x-www-form-urlencoded

rent_time=3600%0d%0aaddress=/#/192.168.1.100%0d%0a

Could result in dnsmasq interpreting the injected address directive, redirecting all DNS queries to a rogue IP — effectively enabling DNS spoofing.

Exploitation Impact

• DNS Cache Poisoning: Redirect traffic to phishing or malware distribution sites.
• MITM Attacks: Intercept sensitive data (credentials, session tokens).
• Denial of Service: Corrupt dnsmasq config to crash the service.
• Persistence: Modify startup scripts or cron jobs via injected shell commands (if combined with other flaws).

Exploitation Status

• Public PoC: Available on GitHub and exploit-db.
• Active Exploitation: Confirmed in honeypot networks by GreyNoise as of March 2026.
• CISA KEV: Listed as of April 1, 2026 (KEV ID: KEV-2026-00312).
• Vendor Patch: No official fix released due to unresponsive vendor.

Detection & Response

Sigma Rules

---
title: Oray Pugongying dnsmasq CRLF Injection Attempt
id: 9c3f1a72-1d4b-4e9a-bf12-8e5d3f7c2a1b
status: experimental
description: Detects HTTP requests to the apply_dhcp.cgi endpoint with CRLF injection patterns in the rent_time parameter.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-116233
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/05
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  product: proxy
  service: http
detection:
  selection:
    c-uri|contains: '/apply_dhcp.cgi'
    cs-method: 'POST'
    c-uriquery|contains:
      - '%0d%0a'
      - '%0D%0A'
      - 'rent_time'
  filter:
    c-ip|startswith:
      - '192.168.'
      - '10.'
      - '172.16.'
  condition: selection and not filter
falsepositives:
  - Internal vulnerability scanners
level: high
---
title: dnsmasq Process Spawned with Suspicious Arguments
id: 8a2e7b1c-5f4d-4a8c-9d3e-6c1f2b9a8d7e
status: experimental
description: Detects dnsmasq being launched with configuration files or arguments that may indicate post-exploitation tampering.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-116233
author: Security Arsenal
date: 2026/04/05
tags:
  - attack.defense_evasion
  - attack.t1036
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/dnsmasq'
    CommandLine|contains:
      - '--conf-file=/tmp/'
      - '--dhcp-range='
      - '--address='
      - '--server='
  condition: selection
falsepositives:
  - Custom dnsmasq configurations in lab environments
level: medium

KQL (Microsoft Sentinel / Defender)

// Hunt for CRLF injection attempts in HTTP logs via CEF/Syslog
CommonSecurityLog
| where DeviceVendor == "Oray" or DeviceProduct contains "Pugongying"
| where RequestURL contains "/apply_dhcp.cgi"
| where RequestMethod == "POST"
| where RequestURL contains "%0d%0a" or RequestURL contains "%0D%0A"
| extend InjectionPattern = extract(@'rent_time=[^&]*(%0[dD]%0[aA])[^&]*', 1, RequestURL)
| where isnotempty(InjectionPattern)
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, InjectionPattern
| sort by TimeGenerated desc

// Hunt for dnsmasq processes with suspicious arguments
DeviceProcessEvents
| where ProcessName == "dnsmasq"
| where ProcessCommandLine has_any ("--conf-file=/tmp/", "--dhcp-range=", "--address=", "--server=")
| project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessAccountName
| sort by Timestamp desc

Velociraptor VQL

-- Hunt for dnsmasq processes with suspicious command lines
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name == "dnsmasq"
  AND CommandLine =~ "--conf-file=/tmp/|--dhcp-range=|--address=|--server="

-- Hunt for recently modified dnsmasq config files in /tmp or /etc
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs="/tmp/dnsmasq*.conf,/etc/dnsmasq.d/*.conf")
WHERE Mtime > now() - 86400  -- Modified in last 24 hours

Remediation Script (Bash)

#!/bin/bash
# CVE-2026-116233 Mitigation Script for Oray Pugongying X5 Pro
# Disables DHCP server functionality in dnsmasq if not required
# Blocks external access to the web management interface

set -e

CONFIG_FILE="/etc/dnsmasq.conf"
BACKUP_FILE="/etc/dnsmasq.conf.bak.$(date +%s)"
IPTABLES_RULE="-A INPUT -p tcp --dport 80 -s 192.168.0.0/16 -j ACCEPT"
IPTABLES_DROP="-A INPUT -p tcp --dport 80 -j DROP"

echo "[+] Backing up current dnsmasq config..."
cp "$CONFIG_FILE" "$BACKUP_FILE"

echo "[+] Disabling DHCP server in dnsmasq..."
sed -i 's/^dhcp-range=/#dhcp-range=/' "$CONFIG_FILE"
sed -i 's/^dhcp-option=/#dhcp-option=/' "$CONFIG_FILE"

echo "[+] Restarting dnsmasq service..."
systemctl restart dnsmasq

echo "[+] Blocking external HTTP access to management interface..."
iptables "$IPTABLES_RULE"
iptables "$IPTABLES_DROP"

echo "[+] Saving iptables rules..."
iptables-save > /etc/iptables/rules.v4

echo "[+] Mitigation complete. Verify dnsmasq is not serving DHCP:"
ps aux | grep dnsmasq | grep -v grep

echo "[+] Check listening ports:"
netstat -tulnp | grep :67

echo "[+] If DHCP is required, restrict web interface access to trusted IPs only."

Remediation

Immediate Actions

1. Isolate Affected Devices: If the Oray Pugongying X5 Pro is exposed to the internet, take it offline immediately.
2. Disable DHCP Server: If not required, disable dnsmasq’s DHCP functionality via configuration or service stop.
3. Restrict Web Interface Access: Use firewall rules to allow management interface access only from trusted internal IPs.
4. Monitor for Exploitation: Deploy the detection rules above and monitor for suspicious DNS or process activity.

Long-Term Fixes

• Firmware Update: Monitor Oray’s official channels for a patched firmware release. As of April 2026, no update is available.
• Replace Device: Consider replacing unpatched devices with alternatives from responsive vendors (e.g., OpenWrt-compatible hardware).
• Network Segmentation: Place IoT and SOHO devices in isolated VLANs with strict egress filtering.
• DNS Security: Deploy DNSSEC and use encrypted DNS (DoH/DoT) to mitigate spoofing risks.

Vendor & Regulatory Deadlines

• CISA KEV Deadline: Federal agencies must remediate by May 1, 2026.
• NIST Guidance: Follow NIST SP 800-40 for vulnerability management.

Executive Takeaways

• CVE-2026-116233 is a critical, unauthenticated, remote vulnerability in a widely deployed IoT device.
• No patch is available — defenders must rely on mitigations and detection.
• CRLF injection can lead to DNS spoofing, MITM, and data theft.
• Immediate isolation and access restriction are essential.
• Long-term strategy should include vendor accountability and secure-by-design procurement.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub