Live › vulnerability › CVE-2026-121606
NVD (from VulDB) says Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 routers up to firmware 6.4.9 improperly verify the cryptographic signature of firmware: manipulating the sign argument of verify_sign in fs2/bin/iscm defeats the check. NVD says it can be launched remotely and that an exploit is public. The vendor did not respond to the researcher; no fix is known. How a remote attacker reaches the update path is not described.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 01:45 UTC. All times on this page are UTC.
Owners of the Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 routers on firmware 6.4.9 or older are listed as affected. NVD describes the attack as remote but gives no detail on what exposure it needs. Other router models and networks without these devices can skip it.
No product ranges from the sources yet.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification of cryptographic signature. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121606")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.