CVE-2026-121606 Details
Description
A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification of cryptographic signature. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability exists in Qihoo 360 Smart Camera models D621-2, D603-2, D600-2, D619, D606-6, and D706, all firmware versions through 6.4.9. The issue lies in the firmware signature verification process, specifically in the 'verify_sign' function of the 'fs2/bin/iscm' component. The vulnerability allows for improper verification of cryptographic signatures, as the function erroneously accepts empty signature strings as valid. This flaw can be exploited remotely, bypassing the intended signature verification to flash unsigned firmware onto the device.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/gajgdm6-cpu/cf98af20ddb77f27a7c112214a6280f7 | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-121606 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1023261 | [email protected] | Permission Required |
| https://vuldb.com/vuln/430443 | [email protected] | Permission Required |
| https://vuldb.com/vuln/430443/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Qihoo 360 D621-2 | >= 6.0.24, <= 6.4.9 (semver) |
CPE
Remediation
| |
| Qihoo 360 D603-2 | >= 6.0.24, <= 6.4.9 (semver) |
CPE
Remediation
| |
| Qihoo 360 D600-2 | >= 6.0.24, <= 6.4.9 (semver) |
CPE
Remediation
| |
| Qihoo 360 D619 | >= 6.0.24, <= 6.4.9 (semver) |
CPE
Remediation
| |
| Qihoo 360 D606-6 | >= 6.0.24, <= 6.4.9 (semver) |
CPE
Remediation
| |
| Qihoo 360 D706 | >= 6.0.24, <= 6.4.9 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | [email protected] |