CVE-2026-121606
Deferred Deferred - Pending Action

Improper Signature Verification in Qihoo 360 D-Series Firmware

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulDB

Description
A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification of cryptographic signature. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121606
EUVD
EUVD-2026-116670

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-121606 is a cryptographic signature bypass in Qihoo 360 Smart Camera firmware. The verify_sign function in fs2/bin/iscm incorrectly accepts an empty signature string as valid, allowing unsigned firmware to be installed. The attack exploits a flaw where the function returns valid for empty signatures and the upgrade handler only checks for the sign field's presence, not its validity.

Detection Guidance

To detect this vulnerability, monitor network traffic for firmware update requests to Qihoo 360 devices. Check if the 'sign' field in JSON payloads is empty or malformed. Inspect logs for unsigned firmware flashes or unexpected MTD partition writes. Use packet capture tools like tcpdump or Wireshark to analyze HTTP traffic to the device's update endpoints.

Impact Analysis

This vulnerability allows remote attackers to install unsigned firmware on affected devices. This can lead to persistent remote code execution (RCE) that survives reboots, giving attackers full control over the device. The attack can be executed remotely via network access to the firmware update mechanism.

Mitigation Strategies

Immediately isolate affected Qihoo 360 devices from untrusted networks. Disable automatic firmware updates if possible. Block HTTP-based firmware update channels and enforce HTTPS with certificate validation. Monitor for unauthorized firmware flashes and restrict access to the device's update mechanisms until a patch is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121606. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...