Qihoo 360 device firmware signature verification flaw
The firmware check on 360 devices is broken, and attackers can hit them remotely!
Summary
Qihoo 360 device firmware does not properly verify its cryptographic signature, so a remote attacker can attack it. Versions up to 6.4.9 are affected, and public exploit code exists. The vendor did not respond to the disclosure.
What to do
Check that the device runs firmware newer than 6.4.9, and read the vendor's advisory. The vendor did not respond, so no fixed version is confirmed.
Update these devices now!
- Qihoo 360 D600-2
- Qihoo 360 D603-2
- Qihoo 360 D606-6
- Qihoo 360 D619
- Qihoo 360 D621-2
- Qihoo 360 D706
Products and platforms
CVE IDs
Sources
Times
First published
First seen