CVE-2026-121609
Hard-coded credentials in Qihoo 360 M5 Router
- CVSS 4.0
- 9.3 critical
- EPSS
- —
- Published
- ·
- Modified
Hard-coded credentials in the /etc/init.d/mpt Home function of Qihoo 360 Whole Home Router M5 boot script enable remote unauthenticated access. Attackers trigger it over the network on vulnerable firmware. They gain admin credentials and full device control. All users of version 4.0.17.1566 are affected.
What to do: Qihoo has not provided a fix for CVE-2026-121609. Contact the vendor for a workaround.
| Product | Affected |
|---|---|
| Qihoo 360 Whole Home Router M5 | 4.0.17.1566 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Weakness
- CWE-259, CWE-798
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
0 storiesNo ingested article mentions this CVE yet.