{"id":"CVE-2026-121609","published":"2026-11-04T02:17:20.243","lastModified":"2026-11-04T02:17:20.413","description":"A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-259","CWE-798"],"vendors":[],"products":[],"references":[{"url":"https://gist.github.com/gajgdm6-cpu/c8c3bbdeb51c076317834b41c3a919f2","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-121609","tags":[]},{"url":"https://vuldb.com/submit/1023264","tags":[]},{"url":"https://vuldb.com/vuln/430446","tags":[]},{"url":"https://vuldb.com/vuln/430446/cti","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/gajgdm6-cpu/c8c3bbdeb51c076317834b41c3a919f2","tags":[]}],"hasPoc":true,"ai":{"summary":"Hard-coded credentials in the boot script '/etc/init.d/mpt' of Qihoo 360 Whole Home Router M5 v4.0.17.1566 allow remote attackers to authenticate as privileged users without credentials, enabling full system compromise.","exploitability":"Trivial to exploit remotely with no authentication or user interaction required, as the hard-coded credentials are embedded in the device's boot script and accessible over the network.","blast_radius":"Complete compromise of confidentiality, integrity, and availability of the affected router, potentially enabling lateral movement into internal networks connected to it.","remediation":"Upgrade to firmware version 4.0.17.1567 or later if available; otherwise, disable the 'Home' functionality of the MPT service and restrict access to the /etc/init.d/mpt script via file permissions and network segmentation until a patch is applied.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["hardcoded-credential","boot-script","router","no-auth","iot"],"model":"garnet-coder","analyzedAt":"2026-11-04T09:42:58.452Z"}}