{"id":"CVE-2026-121606","kind":"vulnerability","aliases":["CVE-2026-121606"],"related":[],"title":"Qihoo 360 router firmware: signature check flaw allows unsigned firmware installs","description":"A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification of cryptographic signature. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"NVD (from VulDB) says Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 routers up to firmware 6.4.9 improperly verify the cryptographic signature of firmware: manipulating the sign argument of verify_sign in fs2/bin/iscm defeats the check. NVD says it can be launched remotely and that an exploit is public. The vendor did not respond to the researcher; no fix is known. How a remote attacker reaches the update path is not described.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firmware","home-router","infrastructure","iot","qihoo-360"],"not_affected_if":["firmware-newer-than-6.4.9","other-router-models","remote-management-disabled"],"how_to_check":"- Check the firmware version in the router admin page; 6.4.9 or older on D621-2, D603-2, D600-2, D619, D606-6 or D706 is listed as affected.\n- Whether remote (WAN) management is on by default is not stated in the sources; check that it is disabled in the admin settings.\n- If you have the firmware image, look at verify_sign in fs2/bin/iscm.","fix":null,"status":"open","published_at":"2026-11-04T01:17:23+00:00","first_seen_at":"2026-11-04T01:45:48+00:00","triaged_at":"2026-11-04T01:46:18+00:00","updated_at":"2026-11-04T01:47:39+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-04T01:46:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Qihoo 360 router firmware: signature check flaw allows unsigned firmware installs","impact":"high","summary":"Qihoo 360 D-series routers up to firmware 6.4.9 fail to verify the cryptographic signature of firmware updates, because the verify_sign function in fs2/bin/iscm mishandles the sign argument. An attacker on the internet can likely push malicious firmware or bypass update authenticity checks.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["qihoo-360","home-router","firmware","iot"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker installs malicious firmware or bypasses update signature checks","analyst_note":"Confirm whether any vendor fix or firmware version beyond 6.4.9 exists and whether remote management is exposed by default; check the NVD entry and vendor advisories.","how_to_check":"- Check the installed firmware version on the router's admin interface against `6.4.9` and below\n- Look for `fs2/bin/iscm` and the `verify_sign` function in the firmware image if you have it\n- unknown whether a remote management or update service is exposed on your device","plain_action":"If you own a Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 or D706 router on firmware 6.4.9 or older, check the manufacturer's site for an update and turn off remote management until one is installed.","needs_analyst":true,"not_affected_if":["other-router-models","firmware-newer-than-6.4.9","remote-management-disabled"],"who_is_affected":"Owners and operators of the listed Qihoo 360 D-series routers on firmware up to 6.4.9 are exposed, especially where remote access or automatic updates are enabled. Networks that do not use these devices can skip it. The sources do not say whether the vendor has released a fix; it was reported that the vendor did not respond.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000783,"input_tokens":4218,"output_tokens":723,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether any vendor fix or firmware version beyond 6.4.9 exists and whether remote management is exposed by default; check the NVD entry and vendor advisories.","search":"'-121606':14A,17A '-2':33B,35B,37B,112C,114C,116C '-2026':13A,16A '-360':25B '-6':40B,119C '360':2A,31B,110C '6.4.9':47B,124C 'affect':125C 'allow':8A 'argument':58B,148C 'attack':95B,158C 'check':6A,66B 'compon':140C 'contact':178C 'cryptograph':51B,155C 'cve':12A,15A 'd600':36B,115C 'd603':34B,113C 'd606':39B,118C 'd619':38B,117C 'd621':32B,111C 'd706':42B,121C 'defeat':64B 'describ':102B 'disclos':167C 'disclosur':182C 'earli':179C 'exploit':77B,164C 'file':136C 'firmwar':4A,10A,18B,46B,54B,141C 'fix':89B 'flaw':7A 'found':107C 'fs2/bin/iscm':63B,137C 'function':131C 'home':20B 'home-rout':19B 'improp':48B,152C 'infrastructur':22B 'instal':11A 'iot':23B 'issu':128C 'known':91B 'launch':72B,161C 'lead':150C 'manipul':55B,145C 'may':172C 'nvd':26B,67B 'path':99B 'public':79B,170C 'qihoo':1A,24B,30B,109C 'reach':96B 'remot':73B,94B,162C 'research':87B 'respond':84B,186C 'router':3A,21B,43B 'say':29B,68B 'sign':57B,61B,133C,149C 'signatur':5A,52B,142C,156C 'unsign':9A 'updat':98B 'use':174C 'vendor':81B,176C 'verif':143C,153C 'verifi':49B,60B,132C 'vuldb':28B 'vulner':104C 'way':189C","nicknames":[],"mitigations":[],"who_affected":"Owners of the Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 routers on firmware 6.4.9 or older are listed as affected. NVD describes the attack as remote but gives no detail on what exposure it needs. Other router models and networks without these devices can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"If you own a Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 or D706 router on firmware 6.4.9 or older, check the manufacturer's site for an update and turn off remote management until one is installed.","pkeys":[],"ptokens":[],"labels":["critical","firmware","homerouter","infrastructure","iot","qihoo360"],"campaign_type":null,"first_public_at":"2026-11-04T01:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121606","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121606","severity":null,"published_at":"2026-11-04T01:17:23+00:00","modified_at":"2026-11-04T01:17:24+00:00","first_seen_at":"2026-11-04T01:45:48+00:00","fetched_at":"2026-11-04T01:45:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121606:1613","url":null,"severity":null,"published_at":"2026-11-04T01:47:39+00:00","modified_at":"2026-11-04T01:47:39+00:00","first_seen_at":"2026-11-04T01:47:39+00:00","fetched_at":"2026-11-04T01:47:39+00:00","note":"Only source found is the NVD/VulDB text; no vendor advisory, no fix, no public PoC link located (NVD says exploit disclosed, vendor did not respond). Whether remote management is exposed by default is unknown. Nothing verified."}],"documents":[{"id":62944,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121606","title":"NVD: CVE-2026-121606","kind":"advisory","source":"analyst","publisher":null,"text":"A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification of cryptographic signature. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. (CNA: VulDB, CVSS 4.0 10.0)","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}