---
id: CVE-2026-121607
title: >-
  Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command
  injection
summary: >-
  A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to
  6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm.
  Performing a manipulation of the argument host results in os command
  injection. Th…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-78
  - CWE-77
vendor: Qihoo 360
product: D603-2
affected:
  - D603-2 6.4.0
  - D603-2 6.4.1
  - D603-2 6.4.2
  - D603-2 6.4.3
  - D603-2 6.4.4
  - D603-2 6.4.5
  - D603-2 6.4.6
  - D603-2 6.4.7
  - D603-2 6.4.8
  - D603-2 6.4.9
  - D600-2 6.4.0
  - D600-2 6.4.1
  - D600-2 6.4.2
  - D600-2 6.4.3
  - D600-2 6.4.4
  - D600-2 6.4.5
  - D600-2 6.4.6
  - D600-2 6.4.7
  - D600-2 6.4.8
  - D600-2 6.4.9
  - D606-6 6.4.0
  - D606-6 6.4.1
  - D606-6 6.4.2
  - D606-6 6.4.3
  - D606-6 6.4.4
  - D606-6 6.4.5
  - D606-6 6.4.6
  - D606-6 6.4.7
  - D606-6 6.4.8
  - D606-6 6.4.9
  - D706 6.4.0
  - D706 6.4.1
  - D706 6.4.2
  - D706 6.4.3
  - D706 6.4.4
  - D706 6.4.5
  - D706 6.4.6
  - D706 6.4.7
  - D706 6.4.8
  - D706 6.4.9
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T01:15:39.448Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121607'
references:
  - url: 'https://vuldb.com/vuln/430444'
    label: >-
      VDB-430444 | Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os
      command injection
  - url: 'https://vuldb.com/vuln/430444/cti'
    label: 'VDB-430444 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-121607'
    label: CVE-2026-121607 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1023262'
    label: >-
      Submit #1023262 | 360 (Qihoo 360) 360 Smart Camera (IPC) 6.3.0 ~ 6.4.9 OS
      Command Injection
  - url: 'https://gist.github.com/gajgdm6-cpu/e8ef7f512bebb987b0119562873afd5a'
tags:
  - cve.org
epss: 0.01989
epssPercentile: 0.80695
ingestedAt: '2026-11-05T20:33:06.656Z'
---

## Overview

A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Affected

- `D603-2 6.4.0`
- `D603-2 6.4.1`
- `D603-2 6.4.2`
- `D603-2 6.4.3`
- `D603-2 6.4.4`
- `D603-2 6.4.5`
- `D603-2 6.4.6`
- `D603-2 6.4.7`
- `D603-2 6.4.8`
- `D603-2 6.4.9`
- `D600-2 6.4.0`
- `D600-2 6.4.1`
- `D600-2 6.4.2`
- `D600-2 6.4.3`
- `D600-2 6.4.4`
- `D600-2 6.4.5`
- `D600-2 6.4.6`
- `D600-2 6.4.7`
- `D600-2 6.4.8`
- `D600-2 6.4.9`
- `D606-6 6.4.0`
- `D606-6 6.4.1`
- `D606-6 6.4.2`
- `D606-6 6.4.3`
- `D606-6 6.4.4`
- `D606-6 6.4.5`
- `D606-6 6.4.6`
- `D606-6 6.4.7`
- `D606-6 6.4.8`
- `D606-6 6.4.9`
- `D706 6.4.0`
- `D706 6.4.1`
- `D706 6.4.2`
- `D706 6.4.3`
- `D706 6.4.4`
- `D706 6.4.5`
- `D706 6.4.6`
- `D706 6.4.7`
- `D706 6.4.8`
- `D706 6.4.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.