{"id":"CVE-2026-121608","kind":"vulnerability","aliases":["CVE-2026-121608"],"related":[],"title":"Qihoo 360 D603-2 router firmware: timezone parameter allows remote command injection","description":"A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2. This vulnerability affects the function on_push_message of the file /fs2/bin/iscm of the component Timezone Push Handler. Executing a manipulation of the argument tz can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 6.4.0 is able to resolve this issue. Upgrading the affected component is advised. Firmware 6.4.0 gates the path with a new check_timezone_parameter validation (verified by VulDB vulnerability analysis team via disassembly).","summary":"The Qihoo 360 D603-2, D600-2 and D606-6 devices, up to firmware 6.3.2, fail to validate the tz argument in the Timezone Push Handler, so a crafted value can inject operating system commands. An attacker on the internet can run commands on the device, and a public exploit has been disclosed.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firmware","infrastructure","iot","qihoo-360","router"],"not_affected_if":["firmware-6.4.0-or-later"],"how_to_check":"- Check the installed firmware version in the router admin interface and compare it with `6.3.2` and `6.4.0`\n- Confirm whether the device is reachable from the internet and whether remote management is enabled","fix":"- Qihoo 360 D603-2, D600-2 and D606-6: upgrade to `6.4.0` or later","status":"open","published_at":"2026-11-04T02:17:20+00:00","first_seen_at":"2026-11-04T02:46:02+00:00","triaged_at":"2026-11-04T02:47:18+00:00","updated_at":"2026-11-04T02:47:18+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-04T02:47:18Z","model":"claude-haiku-5-5","output":{"fix":"- Qihoo 360 D603-2, D600-2 and D606-6: upgrade to `6.4.0` or later","reach":"internet","title":"Qihoo 360 D603-2 router firmware: timezone parameter allows remote command injection","impact":"high","summary":"The Qihoo 360 D603-2, D600-2 and D606-6 devices, up to firmware 6.3.2, fail to validate the tz argument in the Timezone Push Handler, so a crafted value can inject operating system commands. An attacker on the internet can run commands on the device, and a public exploit has been disclosed.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["qihoo-360","router","firmware","iot"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs operating system commands on the device remotely","analyst_note":"Confirm the default exposure of the timezone push handler and whether authentication is required, using the NVD entry and the VulDB advisory.","how_to_check":"- Check the installed firmware version in the router admin interface and compare it with `6.3.2` and `6.4.0`\n- Confirm whether the device is reachable from the internet and whether remote management is enabled\n- unknown for any other check, the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["firmware-6.4.0-or-later"],"who_is_affected":"The flaw is in the firmware of Qihoo 360 D603-2, D600-2 and D606-6 devices up to version 6.3.2, in the on_push_message function of /fs2/bin/iscm. Firmware 6.4.0 adds a timezone parameter check. Teams that run these devices, especially any reachable from the internet, should look at them; the sources do not say how the device is exposed by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000758,"input_tokens":4257,"output_tokens":665,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121608':15A,18A '-2':4A,29B,31B,86C,88C '-2026':14A,17A '-360':23B '-6':34B,91C '/fs2/bin/iscm':106C '360':2A,27B,84C '6.3.2':39B,94C '6.4.0':145C,159C 'abl':147C 'advis':157C 'affect':97C,154C 'allow':9A 'analysi':174C 'argument':45B,118C 'attack':61B,127C 'check':166C 'command':11A,59B,67B,124C 'compon':109C,155C 'craft':53B 'cve':13A,16A 'd600':30B,87C 'd603':3A,28B,85C 'd606':33B,90C 'determin':81C 'devic':35B,70B 'disassembl':177C 'disclos':77B,137C 'execut':113C 'exploit':74B,133C 'fail':40B 'file':105C 'firmwar':6A,19B,38B,158C 'function':99C 'gate':160C 'handler':50B,112C 'infrastructur':20B 'inject':12A,56B,125C 'internet':64B 'iot':21B 'issu':151C 'launch':130C 'lead':121C 'manipul':115C 'may':128C,139C 'messag':102C 'new':165C 'oper':57B 'os':123C 'paramet':8A,168C 'path':162C 'public':73B,136C 'push':49B,101C,111C 'qihoo':1A,22B,26B,83C 'remot':10A,131C 'resolv':149C 'router':5A,24B 'run':66B 'system':58B 'team':175C 'timezon':7A,48B,110C,167C 'tz':44B,119C 'upgrad':142C,152C 'util':141C 'valid':42B,169C 'valu':54B 'verifi':170C 'version':144C 'via':176C 'vuldb':172C 'vulner':79C,96C,173C","nicknames":[],"mitigations":[],"who_affected":"The flaw is in the firmware of Qihoo 360 D603-2, D600-2 and D606-6 devices up to version 6.3.2, in the on_push_message function of /fs2/bin/iscm. Firmware 6.4.0 adds a timezone parameter check. Teams that run these devices, especially any reachable from the internet, should look at them; the sources do not say how the device is exposed by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["firmware","high","infrastructure","iot","qihoo360","router"],"campaign_type":null,"first_public_at":"2026-11-04T02:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121608","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121608","severity":null,"published_at":"2026-11-04T02:17:20+00:00","modified_at":"2026-11-04T02:17:20+00:00","first_seen_at":"2026-11-04T02:46:02+00:00","fetched_at":"2026-11-04T02:46:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}