Qihoo 360 has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was November 2026 with 4. The median CVSS is 10.0 (critical), with 3 rated critical. Most affected products: D603-2 (2), D621-2 (1), Whole Home Router M5 (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 10.0
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Products
- D603-2 2
- D621-2 1
- Whole Home Router M5 1
Worst active — by depth score
CVE-2026-121609Critical· 10.0Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials55CVE-2026-121607Critical· 10.0Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection55CVE-2026-121606Critical· 10.0Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification55CVE-2026-121608High· 7.3Qihoo 360 D603-2/D600-2/D606-6 Timezone Push iscm on_push_message os command injection40
Qihoo 360 vulnerabilities
CVEs affecting Qihoo 360, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-121609Critical· 10.0Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials
A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploit…
CVE-2026-121608High· 7.3Qihoo 360 D603-2/D600-2/D606-6 Timezone Push iscm on_push_message os command injection
A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2. This vulnerability affects the function on_push_message of the file /fs2/bin/iscm of the component Timezone Push Handler. Executing a manipulation of the …
CVE-2026-121607Critical· 10.0Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection
A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. Th…
CVE-2026-121606Critical· 10.0Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification
A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such man…