NVD disclosure day
CVE-2026-121609
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical vulnerability exists in Qihoo 360 Whole Home Router M5 due to hard-coded credentials in its boot script, enabling unauthenticated remote exploitation. The vendor has not responded to the disclosure, and a publicly available exploit might be in use, posing a risk to network integrity and security.
CVE-2026-121607
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical command injection vulnerability in Qihoo 360 routers allows unauthenticated remote attackers to execute arbitrary OS commands by manipulating a specific argument. The exploit is publicly available, and the vendor has not responded to disclosures, creating a significant risk for internet-exposed devices.
CVE-2026-121606
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in Qihoo 360 devices, allowing remote attackers to bypass firmware signature verification. This improper validation could lead to significant compromise, and exploit code is publicly available. The vendor has not responded to requests for information.