# CVE-2026-121609: Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials

- Exploited (CISA KEV): no
- Published: 2026-11-04
- CVSS: 10 CRITICAL (v4.0)
- EPSS: no score
- CWE: CWE-798, CWE-259

A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| Vercel | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

8 posts seen since 2026-11-04.

- x 2026-11-04: CVE-2026-121609 · CRITICAL · CVSS 10.0  Qihoo 360 Whole Home Router M5 version 4.0.17.1566 has hard-coded credentials in the Boot Script's mpt start function, which may be remotely exploitable. The vendor did not respond to disclosure.  CVSS 2.0 · VulDB https://t.co/gaiwOBpszk (https://x.com/cvedotnew/status/2117859406230565207)
- bluesky 2026-11-04: 🔴 CVE-2026-121609 - Critical (10)  A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects ...  https://www.thehackerwire.com/vulnerability/CVE-2026-121609/  #infosec #cybersecurity #CVE #vulnerability #security #patchstack (https://bsky.app/profile/thehackerwire.bsky.social/post/3mzhnr7gecz27)
- mastodon 2026-11-04: 🔴 CVE-2026-121609 - Critical (10) A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation o… (https://mastodon.social/@thehackerwire/117556595871800025)
- bluesky 2026-11-04: 🚨 CVE-2026-121609 — CVSS 9.3 CRITICAL  A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the functi...  🔎 https://stemshop.top/cve/CVE-2026-121609  #CVE #CyberSecurity #InfoSec (https://bsky.app/profile/stemshop.bsky.social/post/3mzhi5e2agh24)
- x 2026-11-04: 🆕 New CVE: CVE-2026-121609 (CVSS 10.0) Qihoo 360 Whole Home Router M5 · Information disclosure Remote, no login needed.  A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566.  https://t.co/7qjba4YODz (https://x.com/EnclaveRadar/status/2117816810690974101)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-121609 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-121609