Qihoo 360 D603-2/D600-2/D606-6 firmware OS command injection via timezone push handler

Summary

A flaw in the Timezone Push Handler of Qihoo 360 D603-2, D600-2 and D606-6 firmware lets a remote attacker inject OS commands by manipulating the tz argument. Firmware up to 6.3.2 is affected.

What to do

Update the firmware to 6.4.0. Firmware 6.3.2 and older is affected.

Update these devices now.

• Qihoo 360 D603-2
• Qihoo 360 D600-2
• Qihoo 360 D606-6

Fixed in version 6.4.0.

Products and platforms

• Qihoo 360 D603-2
• Qihoo 360 D600-2
• Qihoo 360 D606-6

CVE IDs

• CVE-2026-121608 (opens in a new tab)

Sources

• Write-up: vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · gist.github.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 01:30 UTC

First seen 2026-11-09 15:20 UTC