On this page (7 sections)
A critical vulnerability, tracked as CVE-2026-121609, affects the Qihoo 360 Whole Home Router M5 running firmware 4.0.17.1566. According to the GitHub Advisory Database, the flaw lies in a boot script and results in hard-coded credentials, with remote exploitation described as possible. A public exploit is reported to exist, and the vendor did not respond to the disclosure.
If you run this router at an office, a shop, or a home that hosts anything reachable from the internet, or you manage such devices for clients, treat it as exposed until you have confirmed otherwise.
What happened
The advisory was published on November 4, 2026. It describes a problem in the function Home of the file /etc/init.d/mpt, part of the router's boot script component. The manipulation described leads to hard-coded credentials, and the advisory states that remote exploitation is possible.
Two points stand out. First, the advisory says the exploit is publicly available and might be used. Second, it says the vendor was contacted early but did not respond in any way. That means there is no vendor advisory, no stated fix, and no vendor guidance to rely on. The NVD entry repeats the same description and is not independent confirmation.
Why hard-coded credentials are dangerous
Hard-coded credentials are usernames, passwords or keys baked into firmware instead of being set by the owner. In general, because they ship inside the firmware, the same values tend to be present on many devices of the same kind, so anyone who learns them can try them against every device they can reach. The research does not confirm whether that applies to this specific flaw.
It is also unclear whether changing your own admin password affects the embedded credentials in this case. Depending on where they are used, a password change may help, partly help, or have no effect. The sources do not say, so do not rely on it as a fix.
The CVSS v4 metrics in the advisory describe a network attack vector, low complexity, no required privileges, no user interaction, and high impact on confidentiality, integrity and availability of both the vulnerable and subsequent systems. In plain terms: if the affected service is reachable, the scoring assumes an attacker would not need an account or any action from you.
A compromised router sits in front of everything behind it. It can expose internal traffic, change DNS settings, or be used as a foothold for other attacks. That is general router risk, not a confirmed behavior of this specific flaw.
Who is affected
- Owners of the Qihoo 360 Whole Home Router M5 on firmware 4.0.17.1566, which is the only version named.
- Anyone whose router exposes a management or remote-access service to the internet, since the attack is described as remote.
- Agencies and IT providers that deployed this model for clients or branch offices.
- Small businesses that host a website, camera, or admin panel behind this router with port forwarding.
Whether other firmware versions or Qihoo 360 models share the weakness is not stated in the research.
How to check your exposure
Start by confirming the model and firmware version in the router's admin interface (usually under system or about information). Compare it to 4.0.17.1566. Then check what the router exposes to the internet.
- Log in to the router's admin page from inside your network and note the model and firmware version.
- Review port forwarding, remote management, and any remote-access or cloud features, and list what is enabled.
- From a network outside your own (for example a mobile connection), check whether your public IP answers on administration ports.
- Check your router's logs, if available, for logins or configuration changes you do not recognize.
You can also review the websites and services you host. Webforta offers a free SSL certificate checker and read-only scans of verified websites, though these assess web-facing services, not router firmware.
What to do now
No patch is known, so the goal is to reduce reachability and prepare to replace the device. These are general hardening steps, not vendor-confirmed mitigations for this flaw.
0 of 8 done
Detection and monitoring
Because the fix status is unknown, monitoring matters. Keep an eye on your public IP for unexpected open ports, and watch your websites for signs of tampering that a network-level compromise could lead to, such as certificate changes or DNS changes. Webforta's monitoring can alert you to certificate, DNS and header changes on sites you run. Those alerts are indirect signals only and would not identify this router flaw itself.
Also follow the GitHub advisory and the VulDB entry for updates, since affected versions and patched versions are currently listed as unknown.
Timeline
| Date | Event |
|---|---|
| Before Nov 4, 2026 | Vendor contacted early about the disclosure; no response (date not stated) |
| Nov 4, 2026 | CVE published by NVD and added to the GitHub Advisory Database |
| Nov 4, 2026 | Advisory last updated; no patched version listed |
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.