https://feed.craftedsignal.io/products/qihoo-360-d603-2--6.3.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 02:27:15 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-qihoo-360-os-command-injection/Wed, 04 Nov 2026 02:27:15 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-qihoo-360-os-command-injection/A remote OS command injection vulnerability exists in the Timezone Push Handler of specific Qihoo 360 router models.<p>A vulnerability (CVE-2026-121608) has been identified in Qihoo 360 models D603-2, D600-2, and D606-6 up to version 6.3.2. The issue resides in the 'on_push_message' function of '/fs2/bin/iscm' within the Timezone Push Handler. Manipulation of the 'tz' argument can lead to OS command injection. This attack can be launched remotely, and the exploit has been publicly disclosed. Firmware version 6.4.0 includes a check_timezone_parameter validation to resolve the issue.</p> highadvisory