A critical, remotely exploitable flaw in the firmware signature verification of six Qihoo 360 products (versions up to 6.4.9) has a public exploit. According to the CVE description, the vendor has not responded to the disclosure.
What Is It
CVE-2026-121606 is an improper verification of cryptographic signature vulnerability. It sits in the verify_sign function of the file fs2/bin/iscm, inside the product's Firmware Signature Verification component. An attacker can trigger it by manipulating the sign argument, and the attack can be launched remotely.
VulDB ([email protected]) assigned the CVE, and it has been published to NVD. NVD lists its status as "Deferred," which means NVD has not done its own analysis yet.
Why It Matters
- Severity: VulDB's CVSS 4.0 score is 9.3 (Critical):
AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P. The parsed record also gives a CVSS 3.1 score of 10.0 (Critical):AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. - Low barrier to attack: Both vectors show network access, low attack complexity, no privileges and no user interaction.
- Public exploit: According to the CVE description, the exploit has been disclosed publicly and may be used. The CVSS 4.0 vector agrees, marking exploit maturity as Proof-of-Concept (
E:P). - No vendor response reported: The CVE description, published by VulDB, states that the vendor was contacted early about the disclosure but did not respond in any way.
- KEV status: This CVE has no CISA Known Exploited Vulnerabilities entry in the supplied data. A public exploit exists, but KEV has not confirmed active exploitation.
What's Vulnerable
The affected component is Firmware Signature Verification. These Qihoo 360 products are affected in versions 6.4.0 through 6.4.9:
| Product | Affected Versions |
|---|---|
| D621-2 | 6.4.0 – 6.4.9 |
| D603-2 | 6.4.0 – 6.4.9 |
| D600-2 | 6.4.0 – 6.4.9 |
| D619 | 6.4.0 – 6.4.9 |
| D606-6 | 6.4.0 – 6.4.9 |
| D706 | 6.4.0 – 6.4.9 |
Patch Status
The supplied data lists no patch, fixed version or vendor advisory. According to VulDB's CVE description, the vendor did not respond to the disclosure. With no KEV entry, there is also no CISA required action or remediation due date.
Owners of these models should check for vendor updates themselves. Until a fix is published, keep network exposure of the affected devices as small as possible.