CVE-2026-121607
OS Command Injection in Qihoo 360 D603-2 to D706 up to 6.4.9
- CVSS 4.0
- 9.3 critical
- EPSS
- —
- Published
- ·
- Modified
OS command injection in the testspeed_command function of /fs2/bin/iscm in Qihoo 360 D603-2, D600-2, D606-6 and D706 allows remote attackers to execute arbitrary commands by manipulating the host argument. No authentication or user interaction is required. Affected devices include those up to version 6.4.9. The vendor was contacted but did not respond.
What to do: No fixed version available. Apply Qihoo 360's update for CVE-2026-121607 when released.
| Product | Affected |
|---|---|
| Qihoo D603-2, D600-2, D606-6, D706 | up to 6.4.9 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Weakness
- CWE-77, CWE-78
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
0 storiesNo ingested article mentions this CVE yet.