Vulnerability details
CVE-2026-121607
Qihoo 360 D600-2Qihoo 360 D603-2Qihoo 360 D606-6Qihoo 360 D706
Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection
CVSS 4.0
10.0Critical
Official description
A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 10.0Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P |
| 10.0Critical | 3.1 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C |
| 10.0Critical | 3.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C |
| 10.0High | 2.0 | CVEProject cvelistV5 (CNA) (VulDB) | AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Qihoo 360 | D600-2 | 6.4.0 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.1 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.2 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.3 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.4 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.5 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.6 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.7 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.8 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D600-2 | 6.4.9 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.0 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.1 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.2 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.3 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.4 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.5 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.6 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.7 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.8 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D603-2 | 6.4.9 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.0 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.1 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.2 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.3 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.4 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.5 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.6 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.7 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.8 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D606-6 | 6.4.9 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.0 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.1 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.2 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.3 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.4 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.5 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.6 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.7 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.8 | CVEProject cvelistV5 (CNA) |
| Qihoo 360 | D706 | 6.4.9 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://vuldb.com/vuln/430444 vdb-entrytechnical-description
- https://vuldb.com/vuln/430444/cti signaturepermissions-required
- https://vuldb.com/cve/CVE-2026-121607 third-party-advisory
- https://vuldb.com/submit/1023262 third-party-advisory
- https://gist.github.com/gajgdm6-cpu/e8ef7f512bebb987b0119562873afd5a exploit
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-11-04
- Last updated
- 2026-11-09
- State
- Published
- Assigner (CNA)
- VulDB
- Kolun priority
- 45 · Medium
Exploit prediction (EPSS)
1.98%
Probability of exploitation in 30 days
80.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-78OS Command Injection
- CWE-77Command Injection