Live › vulnerability › CVE-2026-121607
Qihoo 360 D603-2, D600-2, D606-6 and D706 devices up to firmware 6.4.9 let an attacker inject operating system commands through the host argument of the testspeed_command function in /fs2/bin/iscm. A remote attacker can run commands on the device, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 02:46 UTC. All times on this page are UTC.
Devices of the listed Qihoo 360 models running firmware up to 6.4.9 are exposed, and the flaw is reachable remotely according to the sources. The vendor did not respond to disclosure, so no fixed version is known. Teams that do not run these devices can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Qihoo 360 D603-2 | firmware | <= 6.4.9 | – |
| Qihoo 360 D600-2 | firmware | <= 6.4.9 | – |
| Qihoo 360 D606-6 | firmware | <= 6.4.9 | – |
| Qihoo 360 D706 | firmware | <= 6.4.9 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121607")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.