CVE-2026-121606: Qihoo 360 firmware signature bypass

CVE-2026-121606 identifies a critical vulnerability in the verify_sign function of the firmware signature verification component (fs2/bin/iscm) in Qihoo 360 devices models D621-2, D603-2, D600-2, D619, D606-6 and D706 up to version 6.4.9. A remote attacker can manipulate the 'sign' argument to bypass cryptographic signature controls, allowing installation of tampered firmware on these devices. This type of bypass exposes network infrastructure to complete device compromise.

The vulnerability has received a CVSS score of 10.0, the maximum severity rating, and is declared Critical. The exploit has been publicly disclosed and can be used by remote attackers. Vendor Qihoo was contacted early but provided no response. To date, no patch is available. Social signals on X document 2 posts in 24 hours with 27 interactions, indicating widespread awareness among security professionals.

System administrators and security teams must immediately identify all Qihoo 360 devices in their infrastructure and verify the version number. Until a patch is available from the vendor, constant monitoring of firmware behavior, detailed logging, and isolation from critical networks where possible is recommended. Contact the vendor regularly to request updates on patch availability and information on any temporary mitigations.