Search
Find a vulnerability
Search criteria
2 vulnerabilities found for Whole Home Router M5 by Qihoo 360
CVE-2026-121609 (GCVE-0-2026-121609)
Vulnerability from nvd – Published: 2026-11-04 01:45 – Updated: 2026-11-04 01:45
VLAI
EPSS
VEX
Title
Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials
Summary
A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430446 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430446/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121609 | third-party-advisory |
| https://vuldb.com/submit/1023264 | third-party-advisory |
| https://gist.github.com/gajgdm6-cpu/c8c3bbdeb51c0… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Qihoo 360 | Whole Home Router M5 |
Affected:
4.0.17.1566
cpe:2.3:h:qihoo_360:whole_home_router_m5:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:qihoo_360:whole_home_router_m5:*:*:*:*:*:*:*:*"
],
"modules": [
"Boot Script"
],
"product": "Whole Home Router M5",
"vendor": "Qihoo 360",
"versions": [
{
"status": "affected",
"version": "4.0.17.1566"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "xiaomao (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-259",
"description": "Use of Hard-coded Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T01:45:46.225Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430446 | Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430446"
},
{
"name": "VDB-430446 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430446/cti"
},
{
"name": "CVE-2026-121609 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121609"
},
{
"name": "Submit #1023264 | 360 (Qihoo 360) 360 Whole Home Router M5 4.0.17.1566 Use of Hard-coded Credentials",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1023264"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/gajgdm6-cpu/c8c3bbdeb51c076317834b41c3a919f2"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T17:29:10.000Z",
"value": "VulDB entry last update"
}
],
"title": "Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121609",
"datePublished": "2026-11-04T01:45:46.225Z",
"dateReserved": "2026-11-03T16:23:51.359Z",
"dateUpdated": "2026-11-04T01:45:46.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121609 (GCVE-0-2026-121609)
Vulnerability from cvelistv5 – Published: 2026-11-04 01:45 – Updated: 2026-11-04 01:45
VLAI
EPSS
VEX
Title
Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials
Summary
A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430446 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430446/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121609 | third-party-advisory |
| https://vuldb.com/submit/1023264 | third-party-advisory |
| https://gist.github.com/gajgdm6-cpu/c8c3bbdeb51c0… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Qihoo 360 | Whole Home Router M5 |
Affected:
4.0.17.1566
cpe:2.3:h:qihoo_360:whole_home_router_m5:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:qihoo_360:whole_home_router_m5:*:*:*:*:*:*:*:*"
],
"modules": [
"Boot Script"
],
"product": "Whole Home Router M5",
"vendor": "Qihoo 360",
"versions": [
{
"status": "affected",
"version": "4.0.17.1566"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "xiaomao (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-259",
"description": "Use of Hard-coded Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T01:45:46.225Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430446 | Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430446"
},
{
"name": "VDB-430446 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430446/cti"
},
{
"name": "CVE-2026-121609 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121609"
},
{
"name": "Submit #1023264 | 360 (Qihoo 360) 360 Whole Home Router M5 4.0.17.1566 Use of Hard-coded Credentials",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1023264"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/gajgdm6-cpu/c8c3bbdeb51c076317834b41c3a919f2"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T17:29:10.000Z",
"value": "VulDB entry last update"
}
],
"title": "Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121609",
"datePublished": "2026-11-04T01:45:46.225Z",
"dateReserved": "2026-11-03T16:23:51.359Z",
"dateUpdated": "2026-11-04T01:45:46.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}