CVE-2026-121606
A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to…
- Risk score
- 65/100
- CVSS
- 10.0 v3.1
- Published
- 4 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A critical vulnerability (CVSS 10.0) in Qihoo 360 firmware allows remote attackers to exploit improper verification of cryptographic signatures. This could lead to high impact, including confidentiality, integrity, and availability breaches.
- Affected
- {'products': ['Qihoo 360 D621-2', 'Qihoo 360 D603-2', 'Qihoo 360 D600-2', 'Qihoo 360 D619', 'Qihoo 360 D606-6', 'Qihoo 360 D706'], 'packages': [], 'versions': ['up to 6.4.9']}
- Fix
- Check the linked advisory for the concrete fix, as none is provided in the record.
- Exploitation
- Public proof of concept
Why it is Amber
- CVSS 10.0 critical
- Remotely exploitable without logging in
References
Original description
A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification of cryptographic signature. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Last activity 4 Nov 2026. Patch Forecast updates every hour.