---
id: "CVE-2026-121606"
kind: "vulnerability"
aliases: ["CVE-2026-121606"]
title: "Qihoo 360 router firmware: signature check flaw allows unsigned firmware installs"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["firmware", "home-router", "infrastructure", "iot", "qihoo-360"]
not_affected_if: ["firmware-newer-than-6.4.9", "other-router-models", "remote-management-disabled"]
published_at: "2026-11-04T01:17:23+00:00"
first_seen_at: "2026-11-04T01:45:48+00:00"
updated_at: "2026-11-04T01:47:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121606", "first_seen_at": "2026-11-04T01:45:48+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T01:47:39+00:00"}]
---

# Qihoo 360 router firmware: signature check flaw allows unsigned firmware installs

NVD (from VulDB) says Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 routers up to firmware 6.4.9 improperly verify the cryptographic signature of firmware: manipulating the sign argument of verify_sign in fs2/bin/iscm defeats the check. NVD says it can be launched remotely and that an exploit is public. The vendor did not respond to the researcher; no fix is known. How a remote attacker reaches the update path is not described.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the firmware version in the router admin page; 6.4.9 or older on D621-2, D603-2, D600-2, D619, D606-6 or D706 is listed as affected.
- Whether remote (WAN) management is on by default is not stated in the sources; check that it is disabled in the admin settings.
- If you have the firmware image, look at verify_sign in fs2/bin/iscm.

## Timeline

- 2026-11-04T01:45:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121606
- 2026-11-04T01:47:39+00:00 analyst — Only source found is the NVD/VulDB text; no vendor advisory, no fix, no public PoC link located (NVD says exploit disclosed, vendor did not respond). Whether remote management is exposed by default is unknown. Nothing verified.

## Documents

- [advisory] NVD: CVE-2026-121606 https://nvd.nist.gov/vuln/detail/CVE-2026-121606

## From the sources

A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification of cryptographic signature. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_