Qihoo 360 Routers: OS Command Injection (CVE-2026-121608)
A remote OS command injection vulnerability exists in the Timezone Push Handler of specific Qihoo 360 router models.
CVE search metadata
CVE search record: CVE-2026-121608. Severity: high. CVSS: 7.3. KEV: no. Product: Qihoo 360 D603-2 (<= 6.3.2), Qihoo 360 D600-2 (<= 6.3.2), Qihoo 360 D606-6 (<= 6.3.2). Brief: Qihoo 360 Routers: OS Command Injection (CVE-2026-121608). Brief link: https://feed.craftedsignal.io/briefs/2026-11-qihoo-360-os-command-injection/
Triage facts
Revision 1- Applicability
- Qihoo 360 D603-2 (<= 6.3.2), Qihoo 360 D600-2 (<= 6.3.2) +1
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 4, 02:27 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability (CVE-2026-121608) has been identified in Qihoo 360 models D603-2, D600-2, and D606-6 up to version 6.3.2. The issue resides in the 'on_push_message' function of '/fs2/bin/iscm' within the Timezone Push Handler. Manipulation of the 'tz' argument can lead to OS command injection. This attack can be launched remotely, and the exploit has been publicly disclosed. Firmware version 6.4.0 includes a check_timezone_parameter validation to resolve the issue.