CVE-2026-121607Critical· 10.0▾ MidnightA vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. Th…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 55 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
2.0%
A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
D603-2 6.4.0D603-2 6.4.1D603-2 6.4.2D603-2 6.4.3D603-2 6.4.4D603-2 6.4.5D603-2 6.4.6D603-2 6.4.7D603-2 6.4.8D603-2 6.4.9D600-2 6.4.0D600-2 6.4.1D600-2 6.4.2D600-2 6.4.3D600-2 6.4.4D600-2 6.4.5D600-2 6.4.6D600-2 6.4.7D600-2 6.4.8D600-2 6.4.9D606-6 6.4.0D606-6 6.4.1D606-6 6.4.2D606-6 6.4.3D606-6 6.4.4D606-6 6.4.5D606-6 6.4.6D606-6 6.4.7D606-6 6.4.8D606-6 6.4.9D706 6.4.0D706 6.4.1D706 6.4.2D706 6.4.3D706 6.4.4D706 6.4.5D706 6.4.6D706 6.4.7D706 6.4.8D706 6.4.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-121608High· 7.3Qihoo 360 D603-2/D600-2/D606-6 Timezone Push iscm on_push_message os command injection
CVE-2025-59831High· 8.8git-commiters is a Node.js function module providing committers stats for their git repository
CVE-2025-11490Medium· 6.3A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13
CVE-2025-11491Medium· 6.3A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13
CVE-2025-11407Medium· 6.3A weakness has been identified in D-Link DI-7001 MINI 24.04.18B1
CVE-2025-12296Medium· 4.7A security vulnerability has been detected in D-Link DAP-2695 2.00RC13