CVE-2026-121609: Hardcoded Credentials in Qihoo 360 Router M5

CVE-2026-121609 identifies hard-coded credentials in the file /etc/init.d/mpt of the Qihoo 360 Whole Home Router M5 version 4.0.17.1566, specifically in the Home function of the Boot Script component. Manipulation of this data enables unauthorized remote access to the router device, affecting home users and environments adopting this model.

The vulnerability carries CVSS 10.0 (maximum severity) and is classified as critical. The exploit is publicly available and may already be exploited. The vendor was contacted during disclosure but did not respond. NVD officially published the CVE on November 4, 2026, confirming the threat.

Administrators must immediately verify whether the Qihoo 360 Router M5 version 4.0.17.1566 is deployed in their environments. Contact Qihoo for security updates, isolate the device from the network if no patch is available, monitor access logs for anomalous activity, and consider migrating to routers with applied security patches. In enterprise settings, assess the impact on perimeter networks.