CVE-2026-121607: Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection
A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeedcommand of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Qihoo 360 D603-2, D600-2, D606-6, and D706 devices running versions up to 6.4.9 are identified as affected.
What access does an attacker need to exploit this issue?
The attack can be initiated remotely. The supplied vector indicates no privileges or user interaction are required.
Is exploitation likely to be practical?
A public exploit has been disclosed, and the vulnerability is rated critical with high impact to confidentiality, integrity, and availability. The vendor was contacted but did not respond to the disclosure.