CVE-2026-121607

Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection

Published Nov 4, 2026 CVSS 4.0 · 10 Critical EPSS 2.0% KEV · Not listed
Description
A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection
First Time appeared Qihoo 360
Qihoo 360 d600-2
Qihoo 360 d603-2
Qihoo 360 d606-6
Qihoo 360 d706
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:qihoo_360:d600-2:*:*:*:*:*:*:*:*
cpe:2.3:a:qihoo_360:d603-2:*:*:*:*:*:*:*:*
cpe:2.3:a:qihoo_360:d606-6:*:*:*:*:*:*:*:*
cpe:2.3:a:qihoo_360:d706:*:*:*:*:*:*:*:*
Vendors & Products Qihoo 360
Qihoo 360 d600-2
Qihoo 360 d603-2
Qihoo 360 d606-6
Qihoo 360 d706
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Nov 9, 2026, 4:04 PM
Reserved
Nov 3, 2026, 4:23 PM
Status
Deferred
Published
Nov 4, 2026, 2:17 AM
Modified
Nov 9, 2026, 5:17 PM