CVE-2026-121607
Full vulnerability record from the local CVENow database.
Description
A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
CRITICAL
CVSS score
9.3
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-11-04 02:17:19.753000
Last modified
2026-11-04 02:17:19.933000
View original CVE JSON
{
"id": "CVE-2026-121607",
"sourceIdentifier": "[email protected]",
"published": "2026-11-04T02:17:19.753",
"lastModified": "2026-11-04T02:17:19.933",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Qihoo 360",
"product": "D603-2",
"cpes": [
"cpe:2.3:a:qihoo_360:d603-2:*:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "6.4.0",
"status": "affected"
},
{
"version": "6.4.1",
"status": "affected"
},
{
"version": "6.4.2",
"status": "affected"
},
{
"version": "6.4.3",
"status": "affected"
},
{
"version": "6.4.4",
"status": "affected"
},
{
"version": "6.4.5",
"status": "affected"
},
{
"version": "6.4.6",
"status": "affected"
},
{
"version": "6.4.7",
"status": "affected"
},
{
"version": "6.4.8",
"status": "affected"
},
{
"version": "6.4.9",
"status": "affected"
}
]
},
{
"vendor": "Qihoo 360",
"product": "D600-2",
"cpes": [
"cpe:2.3:a:qihoo_360:d600-2:*:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "6.4.0",
"status": "affected"
},
{
"version": "6.4.1",
"status": "affected"
},
{
"version": "6.4.2",
"status": "affected"
},
{
"version": "6.4.3",
"status": "affected"
},
{
"version": "6.4.4",
"status": "affected"
},
{
"version": "6.4.5",
"status": "affected"
},
{
"version": "6.4.6",
"status": "affected"
},
{
"version": "6.4.7",
"status": "affected"
},
{
"version": "6.4.8",
"status": "affected"
},
{
"version": "6.4.9",
"status": "affected"
}
]
},
{
"vendor": "Qihoo 360",
"product": "D606-6",
"cpes": [
"cpe:2.3:a:qihoo_360:d606-6:*:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "6.4.0",
"status": "affected"
},
{
"version": "6.4.1",
"status": "affected"
},
{
"version": "6.4.2",
"status": "affected"
},
{
"version": "6.4.3",
"status": "affected"
},
{
"version": "6.4.4",
"status": "affected"
},
{
"version": "6.4.5",
"status": "affected"
},
{
"version": "6.4.6",
"status": "affected"
},
{
"version": "6.4.7",
"status": "affected"
},
{
"version": "6.4.8",
"status": "affected"
},
{
"version": "6.4.9",
"status": "affected"
}
]
},
{
"vendor": "Qihoo 360",
"product": "D706",
"cpes": [
"cpe:2.3:a:qihoo_360:d706:*:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "6.4.0",
"status": "affected"
},
{
"version": "6.4.1",
"status": "affected"
},
{
"version": "6.4.2",
"status": "affected"
},
{
"version": "6.4.3",
"status": "affected"
},
{
"version": "6.4.4",
"status": "affected"
},
{
"version": "6.4.5",
"status": "affected"
},
{
"version": "6.4.6",
"status": "affected"
},
{
"version": "6.4.7",
"status": "affected"
},
{
"version": "6.4.8",
"status": "affected"
},
{
"version": "6.4.9",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 6.0
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"baseScore": 10.0,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"availabilityImpact": "COMPLETE"
},
"baseSeverity": "HIGH",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-77"
},
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"references": [
{
"url": "https://gist.github.com/gajgdm6-cpu/e8ef7f512bebb987b0119562873afd5a",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-121607",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/1023262",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/430444",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/430444/cti",
"source": "[email protected]"
}
]
}