Qihoo 360 D603-2 and other devices: iscm command injection flaw

Summary

The iscm program on Qihoo 360 D603-2, D600-2, D606-6 and D706 devices has a flaw that lets outsiders inject commands. Versions up to 6.4.9 are affected, and public exploit code exists.

What to do

The vendor did not respond and no fixed version is named. Check that the device runs a version newer than 6.4.9 and read the vendor's advisory.

Update these devices now!

• Qihoo 360 D603-2
• Qihoo 360 D600-2
• Qihoo 360 D606-6
• Qihoo 360 D706

Products and platforms

• Qihoo 360 D603-2
• Qihoo 360 D600-2
• Qihoo 360 D606-6
• Qihoo 360 D706

CVE IDs

• CVE-2026-121607 (opens in a new tab)

Sources

• Write-up: vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · gist.github.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 01:15 UTC

First seen 2026-11-09 15:20 UTC