{"id":"CVE-2026-121609","kind":"vulnerability","aliases":["CVE-2026-121609"],"related":[],"title":"Qihoo 360 M5 router: hard-coded credentials in boot script","description":"A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The Qihoo 360 Whole Home Router M5 firmware version 4.0.17.1566 ships with hard-coded credentials in its boot script /etc/init.d/mpt. Remote attackers can use them to access the device, and a public exploit exists.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"360 Whole Home Router M5","fixed":[],"affected":"4.0.17.1566","ecosystem":"vendor"}],"ecosystems":[],"tags":["home-router","infrastructure","iot","qihoo-360"],"not_affected_if":["other-firmware","other-router-model"],"how_to_check":"- Check the firmware version in the router admin app or web page; 4.0.17.1566 is the version named in the record. Other versions are not stated either way.\n- With shell access, look for /etc/init.d/mpt and read it for embedded usernames or passwords.\n- Which service accepts the credentials is not stated in any source I could reach; check which ports the router exposes to the internet (turn off remote management / WAN access if enabled).","fix":null,"status":"open","published_at":"2026-11-04T02:17:20+00:00","first_seen_at":"2026-11-04T02:46:02+00:00","triaged_at":"2026-11-04T02:47:12+00:00","updated_at":"2026-11-04T02:48:21+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-04T02:47:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Qihoo 360 M5 router: hard-coded credentials in boot script","impact":"high","summary":"The Qihoo 360 Whole Home Router M5 firmware version 4.0.17.1566 ships with hard-coded credentials in its boot script /etc/init.d/mpt. Remote attackers can use them to access the device, and a public exploit exists.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["qihoo-360","home-router","iot"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker logs in with built-in credentials and takes over the router","analyst_note":"Confirm which service accepts the hard-coded credentials and whether the vendor has issued any fix; the sources say the vendor did not respond.","how_to_check":"- Check the firmware version in the router admin interface; look for `4.0.17.1566`.\n- Look for the boot script `/etc/init.d/mpt` on the device if you have shell access.","plain_action":"If you own a Qihoo 360 M5 Whole Home Router, check whether its firmware is version 4.0.17.1566 and contact the vendor or your internet provider for an update, since no fix is stated yet.","needs_analyst":true,"not_affected_if":["other-firmware","other-router-model"],"who_is_affected":"Owners of the Qihoo 360 Whole Home Router M5 on firmware 4.0.17.1566 are exposed, because the boot script contains hard-coded credentials. The sources do not say whether the remote service is reachable from the internet by default. Networks without this device can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000724,"input_tokens":4163,"output_tokens":616,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm which service accepts the hard-coded credentials and whether the vendor has issued any fix; the sources say the vendor did not respond.","search":"'-121609':14A,17A '-2026':13A,16A '-360':29B '/etc/init.d/mpt':50B,86C '360':2A,18A,32B,71C '4.0.17.1566':39B,76C 'access':57B 'affect':79C 'attack':52B,104C 'avail':111C 'boot':10A,48B,90C 'code':7A,44B,98C 'compon':89C 'contact':119C 'credenti':8A,45B,99C 'cve':12A,15A 'devic':59B 'disclosur':123C 'earli':120C 'exist':64B 'exploit':63B,101C,108C 'file':85C 'firmwar':37B 'function':81C 'hard':6A,43B,97C 'hard-cod':5A,42B,96C 'home':20A,24B,34B,73C,82C 'home-rout':23B 'identifi':68C 'infrastructur':26B 'iot':27B 'issu':78C 'lead':94C 'm5':3A,22A,36B,75C 'manipul':93C 'might':113C 'possibl':106C 'public':62B,110C 'qihoo':1A,28B,31B,70C 'remot':51B,100C 'respond':127C 'router':4A,21A,25B,35B,74C 'script':11A,49B,91C 'ship':40B 'use':54B,115C 'vendor':117C 'version':38B 'vulner':66C 'way':130C 'whole':19A,33B,72C","nicknames":[],"mitigations":[],"who_affected":"Owners of the Qihoo 360 Whole Home Router M5 on firmware 4.0.17.1566 are exposed, because the boot script contains hard-coded credentials. The sources do not say whether the remote service is reachable from the internet by default. Networks without this device can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a Qihoo 360 M5 Whole Home Router, check whether its firmware is version 4.0.17.1566 and contact the vendor or your internet provider for an update, since no fix is stated yet.","pkeys":["360wholehomerouterm5","wholehomerouterm5"],"ptokens":["360","home","m5","router","whole"],"labels":["critical","homerouter","infrastructure","iot","qihoo360"],"campaign_type":null,"first_public_at":"2026-11-04T02:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121609","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121609","severity":null,"published_at":"2026-11-04T02:17:20+00:00","modified_at":"2026-11-04T02:17:20+00:00","first_seen_at":"2026-11-04T02:46:02+00:00","fetched_at":"2026-11-04T02:46:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121609:1618","url":null,"severity":null,"published_at":"2026-11-04T02:48:21+00:00","modified_at":"2026-11-04T02:48:21+00:00","first_seen_at":"2026-11-04T02:48:21+00:00","fetched_at":"2026-11-04T02:48:21+00:00","note":"Only the NVD/VulDB CNA text is available. It says remote exploitation is possible, a public exploit exists, and the vendor did not respond. No source names the service that accepts the credentials, no exploit link was found, and no fix is stated. Nothing marked verified. VulDB submission 1023264 (user xiaomao) is the likely original report, but I could not read it. Settling it needs the VulDB entry or the researcher's GitHub write-up."}],"documents":[{"id":63346,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121609","title":"NVD CVE-2026-121609 (VulDB CNA text)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}