جزئیات آسیب‌پذیری
CVE-2026-121606
Qihoo 360 D600-2Qihoo 360 D603-2Qihoo 360 D606-6Qihoo 360 D619Qihoo 360 D621-2Qihoo 360 D706
Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification
CVSS 4.0
10.0بحرانی
نمای کلی
اکسپلویت‌های عمومی
اخبار مرتبط
خط زمانی
خلاصه‌ی فارسی
خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.
شرح رسمی (انگلیسی)
A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification of cryptographic signature. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 10.0بحرانی | 4.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P |
| 10.0بحرانی | 3.1 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C |
| 10.0بحرانی | 3.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C |
| 10.0بالا | 2.0 | CVEProject cvelistV5 (CNA) (VulDB) | AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Qihoo 360 | D600-2 | 6.4.0 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.1 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.2 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.3 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.4 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.5 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.6 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.7 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.8 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.9 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.0 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.1 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.2 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.3 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.4 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.5 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.6 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.7 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.8 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.9 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.0 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.1 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.2 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.3 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.4 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.5 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.6 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.7 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.8 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.9 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.0 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.1 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.2 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.3 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.4 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.5 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.6 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.7 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.8 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D619 | 6.4.9 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.0 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.1 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.2 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.3 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.4 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.5 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.6 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.7 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.8 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D621-2 | 6.4.9 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.0 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.1 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.2 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.3 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.4 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.5 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.6 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.7 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.8 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.9 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۵- https://vuldb.com/vuln/430443 vdb-entrytechnical-description
- https://vuldb.com/vuln/430443/cti signaturepermissions-required
- https://vuldb.com/cve/CVE-2026-121606 third-party-advisory
- https://vuldb.com/submit/1023261 third-party-advisory
- https://gist.github.com/gajgdm6-cpu/cf98af20ddb77f27a7c112214a6280f7 exploit
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۸/۱۳
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۸/۱۳
- وضعیت
- PUBLISHED
- صادرکننده (CNA)
- VulDB
- اولویت کلون
- به‌زودی
پیش‌بینی بهره‌برداری (EPSS)
امتیاز EPSS برای این CVE هنوز منتشر نشده است.
ضعف‌ها (CWE)
- CWE-347Improper Verification of Cryptographic Signature
- CWE-345Insufficient Verification of Data Authenticity