# CVE-2026-121606: Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification

- Exploited (CISA KEV): no
- Published: 2026-11-04
- CVSS: 10 CRITICAL (v4.0)
- EPSS: no score
- CWE: CWE-347, CWE-345

A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification of cryptographic signature. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| Vercel | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

7 posts seen since 2026-11-04.

- x 2026-11-04: CVE-2026-121606 · CRITICAL · CVSS 10.0  Qihoo 360 devices D621-2, D603-2, D600-2, D619, D606-6, and D706 up to version 6.4.9 have a vulnerability in the verify_sign function, allowing improper verification of cryptographic signatures.  CVSS 2.0 · VulDB https://t.co/SKekx2KgaB (https://x.com/cvedotnew/status/2117889646701285820)
- x 2026-11-04: 🆕 New CVE: CVE-2026-121606 (CVSS 10.0) Qihoo 360 D621-2 + 5 more · Information disclosure Remote, no login needed.  A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9.  https://t.co/MgJPPsF9sb (https://x.com/EnclaveRadar/status/2117801676501389458)
- bluesky 2026-11-04: 🚨 CVE-2026-121606 — CVSS 9.3 CRITICAL  A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affe...  🔎 https://stemshop.top/cve/CVE-2026-121606  #CVE #CyberSecurity #InfoSec (https://bsky.app/profile/stemshop.bsky.social/post/3mzhbksokzt2y)
- bluesky 2026-11-04: CVE Radar \| CVE-2026-121606 \| CVSS 10.0  Qihoo 360 Firmware Signature Verification Flaw  CVE-2026-121606 affects Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6, and D706 devices through version 6.4.9.  Full analysis: https://t.me/aiutocomputerhelp_lab/1363 (https://bsky.app/profile/aiuto-ch.bsky.social/post/3mzh7g5d5pmba)
- bluesky 2026-11-04: CVE-2026-121606 - d621-2 Certain Qihoo 360 models (D621-2, D603-2, D600-2, D619, D606-6, D706) can incorrectly verify the digital signature of firmware. This mistake could let an attacker remotely install…  Too many irrelevant or confusing CVEs? Use stackflag.com  #d6212 #qihoo3… (https://bsky.app/profile/stackflag.bsky.social/post/3mzh7cqjzqu2z)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-121606 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-121606