CVE-2026-121609

Summary

Hard-coded credentials in the boot script '/etc/init.d/mpt' of Qihoo 360 Whole Home Router M5 v4.0.17.1566 allow remote attackers to authenticate as privileged users without credentials, enabling full system compromise.

Exploitability

Trivial to exploit remotely with no authentication or user interaction required, as the hard-coded credentials are embedded in the device's boot script and accessible over the network.

Blast radius

Complete compromise of confidentiality, integrity, and availability of the affected router, potentially enabling lateral movement into internal networks connected to it.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 4.0.17.1567 or later if available; otherwise, disable the 'Home' functionality of the MPT service and restrict access to the /etc/init.d/mpt script via file permissions and network segmentation until a patch is applied.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.