Qihoo 360 Whole Home Router M5 hard-coded credentials (CVE-2026-121609)
A vulnerability in Qihoo 360 Whole Home Router M5 4.0.17.1566 involves hard-coded credentials in the Home function of the /etc/init.d/mpt boot script.
CVE search metadata
CVE search record: CVE-2026-121609. Severity: critical. CVSS: 10.0. KEV: no. Product: Whole Home Router M5 4.0.17.1566. Brief: Qihoo 360 Whole Home Router M5 hard-coded credentials (CVE-2026-121609). Brief link: https://feed.craftedsignal.io/briefs/2026-11-qihoo-router-hardcoded-creds/
Triage facts
Revision 1- Applicability
- Whole Home Router M5 4.0.17.1566
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 4, 02:26 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability was identified in the Home function of the /etc/init.d/mpt file within the Boot Script component of the Qihoo 360 Whole Home Router M5 4.0.17.1566. This manipulation leads to hard-coded credentials. The vulnerability allows for remote exploitation, and a public exploit is available. The vendor did not respond to disclosure attempts.