CVE-2026-121606: critical vulnerability in Qihoo 360 D621-2
Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 10epss 0.2%
A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification of cryptographic signature. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Affected products
Qihoo 360 · D600-2Qihoo 360 · D603-2Qihoo 360 · D606-6Qihoo 360 · D619Qihoo 360 · D621-2Qihoo 360 · D706public PoCs found — 1
cve_referencegist.github.com/gajgdm6-cpu/cf98af20ddb77f27a7c112214a6280f7unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Qihoo 360 D621-2
In the same product, most dangerous first.