Qihoo 360 Whole Home Router M5 boot script has hard-coded credentials

The 360 M5 router has a built-in fixed password that lets attackers in remotely!

Summary

The boot script (/etc/init.d/mpt) of Qihoo 360 Whole Home Router M5 firmware 4.0.17.1566 contains hard-coded credentials, and remote exploitation is possible. Public exploit code exists, and the vendor did not respond to early disclosure.

What to do

No fixed version is named. Check that the firmware is newer than 4.0.17.1566 and look for the vendor's advisory.

Update these devices now!

Qihoo 360 Whole Home Router M5

Products and platforms

Qihoo 360 Whole Home Router M5

CVE IDs

CVE-2026-121609 (opens in a new tab)

Sources

Write-up: vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · gist.github.com (opens in a new tab)

Times

First published 2026-11-04 01:45 UTC

First seen 2026-11-09 15:20 UTC