Live › vulnerability › CVE-2026-121608
The Qihoo 360 D603-2, D600-2 and D606-6 devices, up to firmware 6.3.2, fail to validate the tz argument in the Timezone Push Handler, so a crafted value can inject operating system commands. An attacker on the internet can run commands on the device, and a public exploit has been disclosed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 02:46 UTC. All times on this page are UTC.
The flaw is in the firmware of Qihoo 360 D603-2, D600-2 and D606-6 devices up to version 6.3.2, in the on_push_message function of /fs2/bin/iscm. Firmware 6.4.0 adds a timezone parameter check. Teams that run these devices, especially any reachable from the internet, should look at them; the sources do not say how the device is exposed by default.
No product ranges from the sources yet.
6.3.2 and 6.4.06.4.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2. This vulnerability affects the function on_push_message of the file /fs2/bin/iscm of the component Timezone Push Handler. Executing a manipulation of the argument tz can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 6.4.0 is able to resolve this issue. Upgrading the affected component is advised. Firmware 6.4.0 gates the path with a new check_timezone_parameter validation (verified by VulDB vulnerability analysis team via disassembly).
This page as .md · .json · in your agent: get_signal("CVE-2026-121608")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.