---
id: "CVE-2026-121608"
kind: "vulnerability"
aliases: ["CVE-2026-121608"]
title: "Qihoo 360 D603-2 router firmware: timezone parameter allows remote command injection"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["firmware", "infrastructure", "iot", "qihoo-360", "router"]
not_affected_if: ["firmware-6.4.0-or-later"]
published_at: "2026-11-04T02:17:20+00:00"
first_seen_at: "2026-11-04T02:46:02+00:00"
updated_at: "2026-11-04T02:47:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121608", "first_seen_at": "2026-11-04T02:46:02+00:00"}]
---

# Qihoo 360 D603-2 router firmware: timezone parameter allows remote command injection

The Qihoo 360 D603-2, D600-2 and D606-6 devices, up to firmware 6.3.2, fail to validate the tz argument in the Timezone Push Handler, so a crafted value can inject operating system commands. An attacker on the internet can run commands on the device, and a public exploit has been disclosed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed firmware version in the router admin interface and compare it with `6.3.2` and `6.4.0`
- Confirm whether the device is reachable from the internet and whether remote management is enabled

## Fix

- Qihoo 360 D603-2, D600-2 and D606-6: upgrade to `6.4.0` or later

## Timeline

- 2026-11-04T02:46:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121608

## From the sources

A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2. This vulnerability affects the function on_push_message of the file /fs2/bin/iscm of the component Timezone Push Handler. Executing a manipulation of the argument tz can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 6.4.0 is able to resolve this issue. Upgrading the affected component is advised. Firmware 6.4.0 gates the path with a new check_timezone_parameter validation (verified by VulDB vulnerability analysis team via disassembly).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_