جزئیات آسیب‌پذیری
CVE-2026-121606
Qihoo 360 D600-2Qihoo 360 D603-2Qihoo 360 D606-6Qihoo 360 D619Qihoo 360 D621-2Qihoo 360 D706
Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification
CVSS 4.0
10.0بحرانی
شرح رسمی (انگلیسی)
A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification of cryptographic signature. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 10.0بحرانی | 4.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P |
| 10.0بحرانی | 3.1 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C |
| 10.0بحرانی | 3.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C |
| 10.0بالا | 2.0 | CVEProject cvelistV5 (CNA) (VulDB) | AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Qihoo 360 | D600-2 | 6.4.0 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.1 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.2 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.3 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.4 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.5 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.6 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.7 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.8 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.9 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.0 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.1 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.2 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.3 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.4 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.5 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.6 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.7 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.8 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.9 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.0 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.1 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.2 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.3 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.4 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.5 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.6 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.7 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.8 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.9 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.0 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.1 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.2 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.3 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.4 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.5 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.6 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.7 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.8 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.9 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.0 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.1 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.2 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.3 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.4 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.5 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.6 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.7 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.8 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.9 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.0 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.1 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.2 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.3 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.4 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.5 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.6 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.7 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.8 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.9 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۵- https://vuldb.com/vuln/430443 vdb-entrytechnical-description
- https://vuldb.com/vuln/430443/cti signaturepermissions-required
- https://vuldb.com/cve/CVE-2026-121606 third-party-advisory
- https://vuldb.com/submit/1023261 third-party-advisory
- https://gist.github.com/gajgdm6-cpu/cf98af20ddb77f27a7c112214a6280f7 exploit
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۸/۱۳
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۸/۱۳
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- VulDB
پیش‌بینی بهره‌برداری (EPSS)
۰٫۲۴٪
احتمال بهره‌برداری در ۳۰ روز
۱۵٫۱٪
صدک (نسبت به همه‌ی CVEها)
ضعف‌ها (CWE)
- CWE-347Improper Verification of Cryptographic Signature
- CWE-345Insufficient Verification of Data Authenticity