CVE record · CVE-2026-121606

Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification

CVSS 10.0 CriticalCriticalEPSS 0.0024 · 15th percentile

Critical, because:

CVSS score 10.0: 9.0 or more.

Published by the CVE Program (CNA: VulDB) at 4 Nov 2026, 01:00 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Qihoo 360	D621-2	affected 6.4.0 affected 6.4.1 affected 6.4.2 affected 6.4.3 affected 6.4.4 affected 6.4.5 affected 6.4.6 affected 6.4.7 affected 6.4.8 affected 6.4.9
Qihoo 360	D603-2	affected 6.4.0 affected 6.4.1 affected 6.4.2 affected 6.4.3 affected 6.4.4 affected 6.4.5 affected 6.4.6 affected 6.4.7 affected 6.4.8 affected 6.4.9
Qihoo 360	D600-2	affected 6.4.0 affected 6.4.1 affected 6.4.2 affected 6.4.3 affected 6.4.4 affected 6.4.5 affected 6.4.6 affected 6.4.7 affected 6.4.8 affected 6.4.9
Qihoo 360	D619	affected 6.4.0 affected 6.4.1 affected 6.4.2 affected 6.4.3 affected 6.4.4 affected 6.4.5 affected 6.4.6 affected 6.4.7 affected 6.4.8 affected 6.4.9
Qihoo 360	D606-6	affected 6.4.0 affected 6.4.1 affected 6.4.2 affected 6.4.3 affected 6.4.4 affected 6.4.5 affected 6.4.6 affected 6.4.7 affected 6.4.8 affected 6.4.9
Qihoo 360	D706	affected 6.4.0 affected 6.4.1 affected 6.4.2 affected 6.4.3 affected 6.4.4 affected 6.4.5 affected 6.4.6 affected 6.4.7 affected 6.4.8 affected 6.4.9

Identifiers: CVE-2026-121606
CNA: VulDB
Weakness (CWE): CWE-345 · CWE-347
Tags: Qihoo 360 D621-2
Qihoo 360 D603-2
Qihoo 360 D600-2
Qihoo 360 D619
Qihoo 360 D606-6
Qihoo 360 D706
Weak cryptography or TLS
CWE-345
Published: 4 Nov 2026
Updated: 4 Nov 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
10.0	Critical	4.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P	CNA (VulDB)Used for this record
10.0	Critical	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C	CNA (VulDB)
10.0	Critical	3.0	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C	CNA (VulDB)
10.0	High	2.0	AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C	CNA (VulDB)

CISA KEV Not listed.
EPSS 0.0024, the 15th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

4 Nov 2026, 01:00 UTC Confirmed by the CVE List
4 Nov 2026, 01:03 UTC First seen by agentprime
4 Nov 2026, 01:17 UTC Confirmed by NVD

Sources

References from the CNA

vuldb.com/vuln/430443 vdb-entrytechnical-description
vuldb.com/vuln/430443/cti signaturepermissions-required
vuldb.com/cve/CVE-2026-121606 third-party-advisory
vuldb.com/submit/1023261 third-party-advisory
gist.github.com/gajgdm6-cpu/cf98af20ddb77f27a7c112214a6280f7 exploit

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.