L2TP Authentication CRLF Injection in Oray Pugongying X5

A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Oray Pugongying X5 Pro 7.6.1 contains a critical CRLF injection vulnerability in its L2TP Authentication component, where unsanitized Username parameters allow attackers to inject carriage return and line feed characters. This flaw (CVSS 9.1) enables remote exploitation without authentication and can be weaponized to manipulate protocol-level communications, inject malicious commands, or bypass security controls. Organizations deploying Oray Pugongying X5 Pro for remote access, VPN termination, or network authentication are at immediate risk, particularly since the vendor has not responded to early disclosure notifications and exploit code is publicly available.

Casky's 323 mapped skills detect this attack pattern by correlating CWE-74 (Improper Neutralization of Special Elements) and CWE-93 (Improper Neutralization of CRLF Sequences) behaviors against MITRE ATT&CK's Initial Access (TA0001) and Persistence (TA0043) techniques. Practitioners using Casky will observe skill findings that flag suspicious L2TP authentication requests containing encoded or raw CRLF sequences (\r\n), unexpected protocol state transitions following authentication attempts, and suspicious session establishment patterns that indicate injected commands. Extended reasoning across these 323 skills enables detection of both direct injection attempts and downstream lateral movement or privilege escalation flows initiated through compromised L2TP sessions, providing defenders with attack chain context beyond the initial exploitation vector.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-116235.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-116235

Casky has 323 skills that investigate the attack patterns behind CVE-2026-116235. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn