CVE-2026-121606
Improper Signature Verification in Qihoo 360 Firmware up to 6.4.9
- CVSS 4.0
- 9.3 critical
- EPSS
- —
- Published
- ·
- Modified
Qihoo 360 firmware signature verification in fs2/bin/iscm allows remote attackers to manipulate the sign argument, bypassing cryptographic checks. This enables malicious firmware installation or system compromise. Triggered remotely with no authentication or user interaction required. Affects D621-2, D603-2, D600-2, D619, D606-6 and D706 models up to 6.4.9.
What to do: Upgrade to a fixed version of Qihoo 360 firmware. Apply vendor update for CVE-2026-121606.
| Product | Affected |
|---|---|
| Qihoo 360 D621-2 | up to 6.4.9 |
| Qihoo 360 D603-2 | up to 6.4.9 |
| Qihoo 360 D600-2 | up to 6.4.9 |
| Qihoo 360 D619 | up to 6.4.9 |
| Qihoo 360 D606-6 | up to 6.4.9 |
| Qihoo 360 D706 | up to 6.4.9 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification of cryptographic signature. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Weakness
- CWE-345, CWE-347
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
0 storiesNo ingested article mentions this CVE yet.