---
id: "CVE-2026-121609"
kind: "vulnerability"
aliases: ["CVE-2026-121609"]
title: "Qihoo 360 M5 router: hard-coded credentials in boot script"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "360 Whole Home Router M5", "fixed": [], "affected": "4.0.17.1566", "ecosystem": "vendor"}]
ecosystems: []
tags: ["home-router", "infrastructure", "iot", "qihoo-360"]
not_affected_if: ["other-firmware", "other-router-model"]
published_at: "2026-11-04T02:17:20+00:00"
first_seen_at: "2026-11-04T02:46:02+00:00"
updated_at: "2026-11-04T02:48:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121609", "first_seen_at": "2026-11-04T02:46:02+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T02:48:21+00:00"}]
---

# Qihoo 360 M5 router: hard-coded credentials in boot script

The Qihoo 360 Whole Home Router M5 firmware version 4.0.17.1566 ships with hard-coded credentials in its boot script /etc/init.d/mpt. Remote attackers can use them to access the device, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:360 Whole Home Router M5 affected 4.0.17.1566 fixed ?

## How to check

- Check the firmware version in the router admin app or web page; 4.0.17.1566 is the version named in the record. Other versions are not stated either way.
- With shell access, look for /etc/init.d/mpt and read it for embedded usernames or passwords.
- Which service accepts the credentials is not stated in any source I could reach; check which ports the router exposes to the internet (turn off remote management / WAN access if enabled).

## Timeline

- 2026-11-04T02:46:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121609
- 2026-11-04T02:48:21+00:00 analyst — Only the NVD/VulDB CNA text is available. It says remote exploitation is possible, a public exploit exists, and the vendor did not respond. No source names the service that accepts the credentials, no exploit link was found, and no fix is stated. Nothing marked verified. VulDB submission 1023264 (user xiaomao) is the likely original report, but I could not read it. Settling it needs the VulDB entry or the researcher's GitHub write-up.

## Documents

- [advisory] NVD CVE-2026-121609 (VulDB CNA text) https://nvd.nist.gov/vuln/detail/CVE-2026-121609

## From the sources

A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_