D619
Monthly
Qihoo 360 router firmware through 6.4.9 contains an improper cryptographic signature verification flaw in the verify_sign function of fs2/bin/iscm, within the Firmware Signature Verification component on models D621-2, D603-2, D600-2, D619, D606-6 and D706. Manipulating the sign argument can cause a signature to be accepted when it should be rejected, giving a network-reachable, unauthenticated attacker potential high confidentiality, integrity and availability impact per the CVSS vector, although the exact network-facing trigger is not described in the available sources. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV confirmation is provided, and no fixed firmware version is published, so the act_now priority rests largely on a single source.
Qihoo 360 router firmware through 6.4.9 contains an improper cryptographic signature verification flaw in the verify_sign function of fs2/bin/iscm, within the Firmware Signature Verification component on models D621-2, D603-2, D600-2, D619, D606-6 and D706. Manipulating the sign argument can cause a signature to be accepted when it should be rejected, giving a network-reachable, unauthenticated attacker potential high confidentiality, integrity and availability impact per the CVSS vector, although the exact network-facing trigger is not described in the available sources. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV confirmation is provided, and no fixed firmware version is published, so the act_now priority rests largely on a single source.