CVE-2026-121606
Full vulnerability record from the local CVENow database.
Description
A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification of cryptographic signature. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
CRITICAL
CVSS score
9.3
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-11-04 01:17:23.880000
Last modified
2026-11-04 01:17:24.050000
View original CVE JSON
{
"id": "CVE-2026-121606",
"sourceIdentifier": "[email protected]",
"published": "2026-11-04T01:17:23.880",
"lastModified": "2026-11-04T01:17:24.050",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification of cryptographic signature. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Qihoo 360",
"product": "D621-2",
"cpes": [
"cpe:2.3:a:qihoo_360:d621-2:*:*:*:*:*:*:*:*"
],
"modules": [
"Firmware Signature Verification"
],
"versions": [
{
"version": "6.4.0",
"status": "affected"
},
{
"version": "6.4.1",
"status": "affected"
},
{
"version": "6.4.2",
"status": "affected"
},
{
"version": "6.4.3",
"status": "affected"
},
{
"version": "6.4.4",
"status": "affected"
},
{
"version": "6.4.5",
"status": "affected"
},
{
"version": "6.4.6",
"status": "affected"
},
{
"version": "6.4.7",
"status": "affected"
},
{
"version": "6.4.8",
"status": "affected"
},
{
"version": "6.4.9",
"status": "affected"
}
]
},
{
"vendor": "Qihoo 360",
"product": "D603-2",
"cpes": [
"cpe:2.3:a:qihoo_360:d603-2:*:*:*:*:*:*:*:*"
],
"modules": [
"Firmware Signature Verification"
],
"versions": [
{
"version": "6.4.0",
"status": "affected"
},
{
"version": "6.4.1",
"status": "affected"
},
{
"version": "6.4.2",
"status": "affected"
},
{
"version": "6.4.3",
"status": "affected"
},
{
"version": "6.4.4",
"status": "affected"
},
{
"version": "6.4.5",
"status": "affected"
},
{
"version": "6.4.6",
"status": "affected"
},
{
"version": "6.4.7",
"status": "affected"
},
{
"version": "6.4.8",
"status": "affected"
},
{
"version": "6.4.9",
"status": "affected"
}
]
},
{
"vendor": "Qihoo 360",
"product": "D600-2",
"cpes": [
"cpe:2.3:a:qihoo_360:d600-2:*:*:*:*:*:*:*:*"
],
"modules": [
"Firmware Signature Verification"
],
"versions": [
{
"version": "6.4.0",
"status": "affected"
},
{
"version": "6.4.1",
"status": "affected"
},
{
"version": "6.4.2",
"status": "affected"
},
{
"version": "6.4.3",
"status": "affected"
},
{
"version": "6.4.4",
"status": "affected"
},
{
"version": "6.4.5",
"status": "affected"
},
{
"version": "6.4.6",
"status": "affected"
},
{
"version": "6.4.7",
"status": "affected"
},
{
"version": "6.4.8",
"status": "affected"
},
{
"version": "6.4.9",
"status": "affected"
}
]
},
{
"vendor": "Qihoo 360",
"product": "D619",
"cpes": [
"cpe:2.3:a:qihoo_360:d619:*:*:*:*:*:*:*:*"
],
"modules": [
"Firmware Signature Verification"
],
"versions": [
{
"version": "6.4.0",
"status": "affected"
},
{
"version": "6.4.1",
"status": "affected"
},
{
"version": "6.4.2",
"status": "affected"
},
{
"version": "6.4.3",
"status": "affected"
},
{
"version": "6.4.4",
"status": "affected"
},
{
"version": "6.4.5",
"status": "affected"
},
{
"version": "6.4.6",
"status": "affected"
},
{
"version": "6.4.7",
"status": "affected"
},
{
"version": "6.4.8",
"status": "affected"
},
{
"version": "6.4.9",
"status": "affected"
}
]
},
{
"vendor": "Qihoo 360",
"product": "D606-6",
"cpes": [
"cpe:2.3:a:qihoo_360:d606-6:*:*:*:*:*:*:*:*"
],
"modules": [
"Firmware Signature Verification"
],
"versions": [
{
"version": "6.4.0",
"status": "affected"
},
{
"version": "6.4.1",
"status": "affected"
},
{
"version": "6.4.2",
"status": "affected"
},
{
"version": "6.4.3",
"status": "affected"
},
{
"version": "6.4.4",
"status": "affected"
},
{
"version": "6.4.5",
"status": "affected"
},
{
"version": "6.4.6",
"status": "affected"
},
{
"version": "6.4.7",
"status": "affected"
},
{
"version": "6.4.8",
"status": "affected"
},
{
"version": "6.4.9",
"status": "affected"
}
]
},
{
"vendor": "Qihoo 360",
"product": "D706",
"cpes": [
"cpe:2.3:a:qihoo_360:d706:*:*:*:*:*:*:*:*"
],
"modules": [
"Firmware Signature Verification"
],
"versions": [
{
"version": "6.4.0",
"status": "affected"
},
{
"version": "6.4.1",
"status": "affected"
},
{
"version": "6.4.2",
"status": "affected"
},
{
"version": "6.4.3",
"status": "affected"
},
{
"version": "6.4.4",
"status": "affected"
},
{
"version": "6.4.5",
"status": "affected"
},
{
"version": "6.4.6",
"status": "affected"
},
{
"version": "6.4.7",
"status": "affected"
},
{
"version": "6.4.8",
"status": "affected"
},
{
"version": "6.4.9",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 6.0
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"baseScore": 10.0,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"availabilityImpact": "COMPLETE"
},
"baseSeverity": "HIGH",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-345"
},
{
"lang": "en",
"value": "CWE-347"
}
]
}
],
"references": [
{
"url": "https://gist.github.com/gajgdm6-cpu/cf98af20ddb77f27a7c112214a6280f7",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-121606",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/1023261",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/430443",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/430443/cti",
"source": "[email protected]"
}
]
}