On this page (7 sections)
CVE-2026-121607 is a critical OS command injection flaw in the Qihoo 360 D603-2, D600-2, D606-6 and D706 devices, in versions up to 6.4.9. According to the GitHub Advisory Database entry, it can be triggered remotely, a public exploit exists, and the vendor did not respond when contacted about the disclosure.
If you run any of these models at an office, a client site or a hosting location, treat them as exposed until you have confirmed otherwise. No patch is listed in the sources we reviewed, so the practical defense today is reducing who can reach the device.
What happened
A vulnerability record published on November 4, 2026 describes a flaw in the function testspeed_command of the file /fs2/bin/iscm. By manipulating the argument host, an attacker can make the device run operating system commands. The record says the attack may be started remotely and that the exploit has been made public and could be used.
The record also states the vendor was contacted early but did not respond in any way. That matters for planning: there is no vendor advisory, fixed version or workaround in the material we have. The GitHub advisory lists affected and patched versions as unknown, so the only bounded statement is the one in the description: versions up to 6.4.9.
Why command injection is so serious
OS command injection happens when a program builds a system command from input it received and does not neutralize that input first. The name of the parameter, host, suggests a network speed or connectivity test function, though the sources do not describe what the feature does. Whatever it is, text meant to be a hostname ends up being interpreted by the system in a way the designer did not intend.
The CVSS v4 metrics in the advisory explain the 9.3 score: network attack vector, low complexity, no attack requirements, no privileges, no user interaction, and high impact on confidentiality, integrity and availability for both the vulnerable and subsequent systems. In plain terms, a remote party needs no account and no help from a user. Running commands on a networked device can, in general, mean data exposure, configuration changes, use as a foothold into adjacent systems, or recruitment into a botnet. Those outcomes are general consequences of this weakness class, not confirmed events for this CVE.
Who is realistically exposed
- Organizations and individuals using the D603-2, D600-2, D606-6 or D706 on version 6.4.9 or earlier.
- Agencies and hosting administrators who manage such devices for clients and may not have them in an asset inventory.
- Any deployment where the device's management or service interfaces are reachable from the internet or from untrusted network segments.
- Networks where these devices can reach servers, databases or admin panels, since a compromised device could be used as a stepping stone. The sources do not describe the device's network role, so this is a precaution rather than a documented outcome.
The sources do not say which service or port reaches the vulnerable function, so we cannot tell you exactly what to block. Assume any network-reachable interface of the device could matter until the vendor or researchers say more.
How to check your exposure
- Inventory your network equipment and identify any Qihoo 360 D603-2, D600-2, D606-6 or D706 units, including ones installed by clients or previous staff.
- Check the firmware version in the device's admin interface or label. Anything at 6.4.9 or lower is within the stated affected range.
- Find out which of the device's interfaces are reachable from the internet, using an external port scan of your own public IP addresses from outside your network.
- Review the device's configuration and logs, if it exposes them, for unfamiliar settings, new accounts or unexpected outbound connections.
For the external check, only scan addresses you own or are authorized to test. If you manage sites, Webforta's security scanner runs read-only scans of websites you verify, but it examines websites, not device firmware, so it cannot confirm whether this device is vulnerable.
What to do now
Since no fixed version is listed, focus on containment and watch for a vendor response.
0 of 7 done
Detection and monitoring afterwards
Because exploitation of this type happens on the device itself, outside-in tools see limited signals. Useful checks include unexpected outbound connections from the device, new or changed settings, unexplained reboots, and odd traffic patterns on your network. Our article on what outside-in detection can and cannot see explains those limits.
For the websites you run, uptime, certificate and DNS monitoring can flag changes such as an unexpected certificate or DNS record, which is sometimes a sign that traffic is being redirected. This does not detect the vulnerability itself.
Timeline
| Date | Event |
|---|---|
| Before publication | Vendor contacted early about the disclosure; no response (per the record) |
| 2026-11-04 | Record published by NVD and added to the GitHub Advisory Database; exploit described as public |
| 2026-11-04 | No patched version or vendor advisory identified in the research |
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.