CVE-2026-121609: Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials
A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Event History
Frequently Asked Questions
Which deployments are known to be affected?
The affected product and version identified in the available data are Qihoo 360 Whole Home Router M5 running version 4.0.17.1566. The issue is in the /etc/init.d/mpt boot script's Home function.
Can this be exploited remotely without prior access?
Yes. The vulnerability is described as remotely exploitable, and the vector indicates network access with low attack complexity, no privileges, and no user interaction required.
Is exploit code available?
Yes. A public exploit is available, so organizations should assume the issue may be actively usable by attackers.
Is a vendor fix or response available?
No vendor response is reported in the available data. The vendor was contacted before disclosure but did not respond.