CVE-2026-121609
A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566
- Risk score
- 65/100
- CVSS
- 10.0 v3.1
- Published
- 4 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A critical vulnerability in Qihoo 360 Whole Home Router M5 4.0.17.1566 allows remote exploitation of hard-coded credentials. An attacker could use this to gain high privileges.
- Affected
- {'product': 'Qihoo 360 Whole Home Router M5', 'version': '4.0.17.1566'}
- Fix
- Check the linked advisory for a fix, as the vendor has not responded to the disclosure.
- Exploitation
- Public proof of concept
Why it is Amber
- CVSS 10.0 critical
- Remotely exploitable without logging in
References
Original description
A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Last activity 4 Nov 2026. Patch Forecast updates every hour.