VulDB has reported a critical hard-coded credentials flaw in the boot script of the Qihoo 360 Whole Home Router M5. According to VulDB, an attacker can exploit it remotely without authentication. VulDB also says a public exploit exists and that the vendor did not respond to its disclosure.
What Is It
CVE-2026-121609 affects the Home function in /etc/init.d/mpt, a file in the router's Boot Script component. According to the CNA (VulDB), manipulating this function leads to hard-coded credentials. The weakness is classified as CWE-259 (Use of Hard-coded Password) and CWE-798 (Use of Hard-coded Credentials).
The CVE is listed in NVD with the status "Deferred."
Why It Matters
VulDB gives the flaw critical scores in every CVSS version it supplied:
- CVSS 3.1: 10.0 Critical (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 Critical, with exploit maturity listed as Proof-of-Concept
- CVSS 2.0: 10.0
Based on VulDB's CVSS 3.1 vector, the attack works over the network. It needs no privileges and no user interaction, and its complexity is low. The scope is "changed," which means a compromise could affect resources beyond the vulnerable component. Confidentiality, integrity and availability impacts are all rated high. These ratings come from the CNA. They have not been independently verified.
The NVD description says the exploit is public and "might be used." This CVE is not in CISA's Known Exploited Vulnerabilities (KEV) catalog, so CISA has not confirmed active exploitation. Even so, if a public exploit exists and the flaw can be reached remotely without authentication as reported, exploitation becomes more likely.
What's Vulnerable
- Vendor: Qihoo 360
- Product: Whole Home Router M5
- Affected version: 4.0.17.1566
- Component: Boot Script (
/etc/init.d/mpt) - CPE:
cpe:2.3:h:qihoo_360:whole_home_router_m5:*:*:*:*:*:*:*:*
The source data lists no other affected versions.
Patch Status
There is no vendor patch or advisory in the supplied data. VulDB says it contacted the vendor before disclosure and got no response. Because the CVE is not in KEV, CISA has not issued a required action or due date.
Owners of M5 units running 4.0.17.1566 should treat the device as potentially exposed until Qihoo 360 confirms the issue or releases a fix. In the meantime, use your own network controls to limit who can reach the router's management interfaces.