CVE-2026-121609— Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials

Quick assessment

Affected

Qihoo 360 Whole Home Router M5

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在奇虎 360 全屋路由器 M5（固件版本 4.0.17.1566）中发现一个安全漏洞。该问题影响启动脚本组件中文件的功能。攻击者可通过操纵该功能利用其中硬编码的凭据。此漏洞可被远程利用，且利用代码已在公开渠道发布，存在被实际利用的风险。研究人员已就此次漏洞披露事宜尽早联系厂商，但厂商未作出任何回应。

CVSS 10.0 · Critical Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1552 · Unsecured Credentials

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

使用硬编码的凭证

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Qihoo 360	Whole Home Router M5	4.0.17.1566	`cpe:2.3:h:qihoo_360:whole_home_router_m5::::::::`

II. Public POCs for CVE-2026-121609

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121609

请登录查看更多情报信息。

Other References for CVE-2026-121609 (5)

https://gist.github.com/gajgdm6-cpu/c8c3bbdeb51c076317834b41c3a919f2 exploit
https://vuldb.com/cve/CVE-2026-121609 third-party-advisory
https://vuldb.com/vuln/430446/cti signature permissions-required
https://vuldb.com/vuln/430446 vdb-entry technical-description
https://vuldb.com/submit/1023264 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121609

Same Patch Batch · Qihoo 360 · 2026-11-04 · 4 CVEs total

CVE-2026-121606	10.0 CRITICAL	Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verif
CVE-2026-121607	10.0 CRITICAL	Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection
CVE-2026-121608	7.3 HIGH	Qihoo 360 D603-2/D600-2/D606-6 Timezone Push iscm on_push_message os command injection

IV. Related Vulnerabilities

Same vendor: Qihoo 360

Same weakness: CWE-798