---
id: "CVE-2026-121607"
kind: "vulnerability"
aliases: ["CVE-2026-121607"]
title: "Qihoo 360 D603-2 and D706 routers: remote command injection via host argument"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Qihoo 360 D603-2", "fixed": [], "affected": "<= 6.4.9", "ecosystem": "firmware"}, {"name": "Qihoo 360 D600-2", "fixed": [], "affected": "<= 6.4.9", "ecosystem": "firmware"}, {"name": "Qihoo 360 D606-6", "fixed": [], "affected": "<= 6.4.9", "ecosystem": "firmware"}, {"name": "Qihoo 360 D706", "fixed": [], "affected": "<= 6.4.9", "ecosystem": "firmware"}]
ecosystems: []
tags: ["firmware", "infrastructure", "iot", "qihoo-360", "routers"]
not_affected_if: ["firmware-above-6.4.9", "not-listed-model"]
published_at: "2026-11-04T02:17:19+00:00"
first_seen_at: "2026-11-04T02:46:01+00:00"
updated_at: "2026-11-04T02:48:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121607", "first_seen_at": "2026-11-04T02:46:01+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T02:48:25+00:00"}]
---

# Qihoo 360 D603-2 and D706 routers: remote command injection via host argument

Qihoo 360 D603-2, D600-2, D606-6 and D706 devices up to firmware 6.4.9 let an attacker inject operating system commands through the host argument of the testspeed_command function in /fs2/bin/iscm. A remote attacker can run commands on the device, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- firmware:Qihoo 360 D603-2 affected <= 6.4.9 fixed ?
- firmware:Qihoo 360 D600-2 affected <= 6.4.9 fixed ?
- firmware:Qihoo 360 D606-6 affected <= 6.4.9 fixed ?
- firmware:Qihoo 360 D706 affected <= 6.4.9 fixed ?

## How to check

- Find the model (D603-2, D600-2, D606-6, D706) and the firmware version in the router's admin page; 6.4.9 or earlier is affected.
- With shell access, check whether /fs2/bin/iscm exists.
- Check whether the router's management interface is reachable from the internet; if so, treat it as exposed.
- No fixed firmware is known. Workaround: block WAN access to management, and replace the device if it must be internet-facing.

## Timeline

- 2026-11-04T02:46:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121607
- 2026-11-04T02:48:25+00:00 analyst — Only NVD/CVE List text found (CNA VulDB). Vendor did not respond to disclosure; no vendor advisory or fixed firmware found. Whether auth is needed for testspeed_command is not stated in text; CNA vector says PR:N but that was not read from a primary source. PoC said public but no link found. No vendor page, so nothing marked verified. X skipped (credits depleted per notes). Sibling CVE-2026-121606 (verify_sign in same iscm) exists.

## Documents

- [advisory] NVD: CVE-2026-121607 https://nvd.nist.gov/vuln/detail/CVE-2026-121607
- [describes] CVE-2026-121607 aggregator record (CVE List V5 data) https://cve.imfht.com/detail/CVE-2026-121607

## From the sources

A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_