# CVE-2026-121606: Qihoo 360 Smart Camera firmware signature verification bypass

Source: https://junglewise.ai/threats/cve-2026-121606-a-vulnerability-has-been-found-in-qihoo-360-d621-2-d603-2-d600-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-121606 · Severity: critical · CVSS 10 · Published 2026-11-04

Qihoo 360's smart camera firmware contains a cryptographic signature verification flaw that allows attackers to flash unsigned firmware. An attacker with network access to the camera's update channel can bypass the security check by providing an empty signature, gaining persistent root-level code execution. This is a critical vulnerability affecting multiple camera models.

Technologies: [Qihoo 360 360 Smart Camera](https://junglewise.ai/threats/technologies/360-smart-camera). Vendors: [Qihoo 360](https://junglewise.ai/threats/vendors/qihoo-360).

## Quick answers

**Is CVE-2026-121606 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121606 being exploited in the wild.

**How severe is CVE-2026-121606?** Critical severity, with a CVSS score of 10, published 4 November 2026.

**Which products and versions are affected?** Qihoo 360 360 Smart Camera 6.0.24 to 6.4.9 (models D621-2, D603-2, D600-2, D619, D606-6, D706).

**Is there a fix for CVE-2026-121606?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-121606 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-121606?** Check whether you run Qihoo 360 360 Smart Camera at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The verify_sign() function in fs2/bin/iscm incorrectly returns 0 ("signature valid") when the signature argument is an empty string, bypassing RSA-2048 and base64 verification entirely. An attacker supplying a JSON firmware update command with an empty "sign" field passes validation and allows unsigned firmware to be downloaded and burned to the MTD partition via burn_helper. iscm runs as root, enabling persistent RCE across reboots; exploitation requires network access to the cloud/app push channel or a MITM position.

## Affected products

- Qihoo 360 360 Smart Camera 6.0.24 to 6.4.9 (models D621-2, D603-2, D600-2, D619, D606-6, D706)

## Timeline

- 2026-11-04: disclosed
- 2026-10-06: other: Vendor contacted via security@360.cn but did not respond substantively

## References

- [https://gist.github.com/gajgdm6-cpu/cf98af20ddb77f27a7c112214a6280f7](https://gist.github.com/gajgdm6-cpu/cf98af20ddb77f27a7c112214a6280f7)
- [https://vuldb.com/cve/CVE-2026-121606](https://vuldb.com/cve/CVE-2026-121606)

## Related threats

- [Qihoo 360 Smart Camera OS command injection in timezone handler](https://junglewise.ai/threats/cve-2026-121608-a-vulnerability-was-determined-in-qihoo-360-d603-2-d600-2-and)
- [Qihoo 360 Smart Camera command injection in testspeed_command](https://junglewise.ai/threats/cve-2026-121607-a-vulnerability-was-found-in-qihoo-360-d603-2-d600-2-d606-6-and)