{"id":"CVE-2026-121607","kind":"vulnerability","aliases":["CVE-2026-121607"],"related":[],"title":"Qihoo 360 D603-2 and D706 routers: remote command injection via host argument","description":"A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Qihoo 360 D603-2, D600-2, D606-6 and D706 devices up to firmware 6.4.9 let an attacker inject operating system commands through the host argument of the testspeed_command function in /fs2/bin/iscm. A remote attacker can run commands on the device, and a public exploit exists.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Qihoo 360 D603-2","fixed":[],"affected":"<= 6.4.9","ecosystem":"firmware"},{"name":"Qihoo 360 D600-2","fixed":[],"affected":"<= 6.4.9","ecosystem":"firmware"},{"name":"Qihoo 360 D606-6","fixed":[],"affected":"<= 6.4.9","ecosystem":"firmware"},{"name":"Qihoo 360 D706","fixed":[],"affected":"<= 6.4.9","ecosystem":"firmware"}],"ecosystems":[],"tags":["firmware","infrastructure","iot","qihoo-360","routers"],"not_affected_if":["firmware-above-6.4.9","not-listed-model"],"how_to_check":"- Find the model (D603-2, D600-2, D606-6, D706) and the firmware version in the router's admin page; 6.4.9 or earlier is affected.\n- With shell access, check whether /fs2/bin/iscm exists.\n- Check whether the router's management interface is reachable from the internet; if so, treat it as exposed.\n- No fixed firmware is known. Workaround: block WAN access to management, and replace the device if it must be internet-facing.","fix":null,"status":"open","published_at":"2026-11-04T02:17:19+00:00","first_seen_at":"2026-11-04T02:46:01+00:00","triaged_at":"2026-11-04T02:47:12+00:00","updated_at":"2026-11-04T02:48:25+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-04T02:47:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Qihoo 360 D603-2 and D706 routers: remote command injection via host argument","impact":"high","summary":"Qihoo 360 D603-2, D600-2, D606-6 and D706 devices up to firmware 6.4.9 let an attacker inject operating system commands through the host argument of the testspeed_command function in /fs2/bin/iscm. A remote attacker can run commands on the device, and a public exploit exists.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["qihoo-360","routers","iot","firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs operating system commands on the device remotely","analyst_note":"Confirm whether the vendor has issued any firmware fix and whether authentication is required to reach testspeed_command; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121607.","how_to_check":"- Check the installed firmware version on the device against the affected range up to `6.4.9`\n- Look for the file `/fs2/bin/iscm` on the device if you have shell access\n- Check whether the device's management interface is reachable from the internet","plain_action":"Check whether your Qihoo 360 D603-2, D600-2, D606-6 or D706 router runs firmware 6.4.9 or earlier, and keep it off the open internet until the vendor releases a fix.","needs_analyst":true,"not_affected_if":["not-listed-model","firmware-above-6.4.9"],"who_is_affected":"Devices of the listed Qihoo 360 models running firmware up to 6.4.9 are exposed, and the flaw is reachable remotely according to the sources. The vendor did not respond to disclosure, so no fixed version is known. Teams that do not run these devices can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000761,"input_tokens":4172,"output_tokens":688,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the vendor has issued any firmware fix and whether authentication is required to reach testspeed_command; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121607.","search":"'-121607':16A,19A '-2':4A,23A,27A,44B,46B,96C,98C '-2026':15A,18A '-360':39B '-6':31A,48B,100C '/fs2/bin/iscm':73B,115C '360':2A,21A,25A,29A,33A,42B,94C '6.4.9':55B,105C 'affect':107C 'argument':13A,66B,121C 'attack':58B,76B,129C 'command':9A,62B,70B,79B,111C,126C 'contact':147C 'could':141C 'cve':14A,17A 'd600':26A,45B,97C 'd603':3A,22A,43B,95C 'd606':30A,47B,99C 'd706':6A,34A,50B,102C 'devic':51B,82B 'disclosur':151C 'earli':148C 'exist':87B 'exploit':86B,135C 'file':114C 'firmwar':35B,54B 'found':91C 'function':71B,109C 'host':12A,65B,122C 'infrastructur':36B 'initi':132C 'inject':10A,59B,127C 'iot':37B 'let':56B 'made':138C 'manipul':118C 'may':130C 'oper':60B 'os':125C 'perform':116C 'public':85B,139C 'qihoo':1A,20A,24A,28A,32A,38B,41B,93C 'remot':8A,75B,133C 'respond':155C 'result':123C 'router':7A,40B 'run':78B 'system':61B 'testspe':69B,110C 'use':143C 'vendor':145C 'via':11A 'vulner':89C 'way':158C","nicknames":[],"mitigations":[],"who_affected":"Devices of the listed Qihoo 360 models running firmware up to 6.4.9 are exposed, and the flaw is reachable remotely according to the sources. The vendor did not respond to disclosure, so no fixed version is known. Teams that do not run these devices can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Check whether your Qihoo 360 D603-2, D600-2, D606-6 or D706 router runs firmware 6.4.9 or earlier, and keep it off the open internet until the vendor releases a fix.","pkeys":["360d6002","360d6032","360d6066","360d706","qihoo360d6002","qihoo360d6032","qihoo360d6066","qihoo360d706"],"ptokens":["360","d600","d603","d606","d706","qihoo"],"labels":["critical","firmware","infrastructure","iot","qihoo360","routers"],"campaign_type":null,"first_public_at":"2026-11-04T02:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121607","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121607","severity":null,"published_at":"2026-11-04T02:17:19+00:00","modified_at":"2026-11-04T02:17:19+00:00","first_seen_at":"2026-11-04T02:46:01+00:00","fetched_at":"2026-11-04T02:46:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121607:1619","url":null,"severity":null,"published_at":"2026-11-04T02:48:25+00:00","modified_at":"2026-11-04T02:48:25+00:00","first_seen_at":"2026-11-04T02:48:25+00:00","fetched_at":"2026-11-04T02:48:25+00:00","note":"Only NVD/CVE List text found (CNA VulDB). Vendor did not respond to disclosure; no vendor advisory or fixed firmware found. Whether auth is needed for testspeed_command is not stated in text; CNA vector says PR:N but that was not read from a primary source. PoC said public but no link found. No vendor page, so nothing marked verified. X skipped (credits depleted per notes). Sibling CVE-2026-121606 (verify_sign in same iscm) exists."}],"documents":[{"id":63347,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121607","title":"NVD: CVE-2026-121607","kind":"advisory","source":"analyst","publisher":null,"text":"A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public. The vendor was contacted early but did not respond in any way. CNA CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0).","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":63348,"url":"https://cve.imfht.com/detail/CVE-2026-121607","title":"CVE-2026-121607 aggregator record (CVE List V5 data)","kind":"other","source":"analyst","publisher":null,"text":"Mirrors CVE List V5: Qihoo 360 D603-2, D600-2, D606-6, D706 up to 6.4.9, testspeed_command in /fs2/bin/iscm, host argument OS command injection, vendor did not respond. No public PoC link found by the aggregator; no confirmed in-the-wild exploitation.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}