CVE-2026-116231

{
  "etk_id": "ETK-2026-2630",
  "cve_id": "CVE-2026-116231",
  "display_id": "CVE-2026-116231",
  "ghsa_id": "GHSA-wf66-wf8x-2jx2",
  "euvd_id": "EUVD-2026-109654",
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "CRLF injection in Pugongying X5 Pro Ser2net",
  "summary": "Pugongying X5 Pro 7.6.1 is affected in the Ser2net component. A remote attacker may inject carriage-return and line-feed characters by influencing the regmsg input, where the affected service is reachable.",
  "mitigation": "Restrict access to the Ser2net service to trusted management networks and disable it where it is not needed. Monitor the vendor for an updated firmware release, as no fixed version is recorded.",
  "vendor": "Oray",
  "product": "Pugongying X5 Pro",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "7.6.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Pugongying X5 Pro",
      "purl": null
    }
  ],
  "cwes": [
    93
  ],
  "cvss_score": 9.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 20.511877366666667,
  "t0_at": "2026-10-26T07:45:15.427000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-26T07:45:15.427000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-26T07:45:15.427000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-116231"
    }
  }
}