Live › vulnerability › CVE-2026-121609
The Qihoo 360 Whole Home Router M5 firmware version 4.0.17.1566 ships with hard-coded credentials in its boot script /etc/init.d/mpt. Remote attackers can use them to access the device, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 02:46 UTC. All times on this page are UTC.
Owners of the Qihoo 360 Whole Home Router M5 on firmware 4.0.17.1566 are exposed, because the boot script contains hard-coded credentials. The sources do not say whether the remote service is reachable from the internet by default. Networks without this device can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| 360 Whole Home Router M5 | vendor | 4.0.17.1566 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121609")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.