{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/qihoo-360-d606-6--6.3.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-121608"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Qihoo 360 D603-2 (\u003c= 6.3.2)","Qihoo 360 D600-2 (\u003c= 6.3.2)","Qihoo 360 D606-6 (\u003c= 6.3.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA vulnerability (CVE-2026-121608) has been identified in Qihoo 360 models D603-2, D600-2, and D606-6 up to version 6.3.2. The issue resides in the 'on_push_message' function of '/fs2/bin/iscm' within the Timezone Push Handler. Manipulation of the 'tz' argument can lead to OS command injection. This attack can be launched remotely, and the exploit has been publicly disclosed. Firmware version 6.4.0 includes a check_timezone_parameter validation to resolve the issue.\u003c/p\u003e\n","date_modified":"2026-11-04T02:27:15Z","date_published":"2026-11-04T02:27:15Z","id":"https://feed.craftedsignal.io/briefs/2026-11-qihoo-360-os-command-injection/","summary":"A remote OS command injection vulnerability exists in the Timezone Push Handler of specific Qihoo 360 router models.","title":"Qihoo 360 Routers: OS Command Injection (CVE-2026-121608)","url":"https://feed.craftedsignal.io/briefs/2026-11-qihoo-360-os-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Qihoo 360 D606-6 (\u003c= 6.3.2)","version":"https://jsonfeed.org/version/1.1"}