On this page (7 sections)
CVE-2026-121606 is a critical flaw in the firmware signature verification of several Qihoo 360 devices. According to the NVD record, the problem affects the models D621-2, D603-2, D600-2, D619, D606-6 and D706 up to version 6.4.9, it can be attacked remotely, and an exploit has been disclosed publicly.
The record also says the vendor was contacted early but did not respond. No fixed version is listed. If you run these devices at an office, a shop or a client site, you will likely need to reduce exposure yourself rather than wait for a patch.
What happened
The CVE was published on 2026-11-04. The description names the function verify_sign in the file fs2/bin/iscm, part of the firmware signature verification component. Manipulating the argument sign leads to improper verification of a cryptographic signature, and the attack can be launched remotely.
The entry points to a public write-up and VulDB pages as references, including a VulDB entry. Only one independent publisher covers the story so far, so details beyond the NVD description are thin. We have not seen a vendor advisory, and the research does not say which product categories these model names correspond to or how they are deployed.
Why signature verification matters
A device that accepts firmware updates should check a cryptographic signature first, so that only images produced by the vendor are installed. If that check can be bypassed, the signature no longer proves who made the image. Depending on how the update path is reachable, an attacker could get unauthorized firmware accepted by the device.
The research does not describe the exact impact, such as whether a full device takeover is possible or what authentication is required. Treat those points as unconfirmed. The CVSS 9.3 rating and the remote attack vector are the reasons to treat this as urgent. We are deliberately not describing how the flaw is triggered.
Who is exposed
- Anyone running one of the listed models on firmware version 6.4.9 or earlier.
- Devices whose management or update interfaces are reachable from the internet are the most at risk, since the attack is described as remote.
- Agencies and hosting providers that manage network gear for clients and may not have it in an inventory.
- Small offices and shops where the device was installed years ago and is rarely checked.
Devices that sit behind a restricted management network are less exposed, but the record does not describe prerequisites, so do not assume they are safe.
How to check your exposure
- List every Qihoo 360 device you own or manage and note the model name printed on the label or shown in the admin interface.
- Compare the model against D621-2, D603-2, D600-2, D619, D606-6 and D706.
- Open the device's admin page from the internal network and read the firmware version. Anything up to 6.4.9 is in the affected range.
- From a machine outside your network, check whether the device's admin or update service answers on the public IP address. If it does, treat it as exposed.
What to do now
No patch is known, so the goal is to shrink the attack surface and prepare to replace or update the device when the vendor responds.
0 of 8 done
Detection and monitoring
Because the flaw concerns firmware integrity, watch for signs that a device was changed: an unexpected firmware version, settings that you did not set, unfamiliar DNS servers, new admin accounts, or unusual outbound traffic from the device. Review any logs the device offers and, where possible, forward them to a central place.
For the websites behind the network, monitoring DNS records, certificates and uptime helps spot tampering that follows a compromised gateway, for example redirected traffic or unexpected certificate changes. Webforta Monitor covers those checks, though it cannot see inside a router or verify its firmware. For background, see our guide to checking whether a website is hacked.
What is still unknown
- Whether a fixed firmware version exists or is planned. The vendor did not respond to the disclosure, per the CVE record.
- Whether the flaw is being exploited in the wild. The record says only that the exploit is public and may be used.
- What privileges are needed and the full impact of a successful attack.
- Which retail products the model names map to.
We will not claim more than the record supports. If a vendor advisory or fixed version appears, follow it over any third-party guidance.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.