CVE-2026-121607 is a critical OS command injection flaw in several Qihoo 360 router models running firmware up to 6.4.9, and it can be triggered remotely. A public exploit is available, and the vendor has not responded.
What Is It
The flaw is in the testspeed_command function of the /fs2/bin/iscm file on Qihoo 360 D603-2, D600-2, D606-6 and D706 devices. An attacker who manipulates the host argument can inject operating system commands. The CNA, VulDB, says the attack can be launched remotely.
VulDB is the source of the CVE record.
Why It Matters
VulDB rates the flaw Critical under every CVSS version it scored. The CVSS 3.1 and 2.0 scores are the maximum of 10.0:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, with exploit maturity rated Proof-of-Concept
- CVSS 2.0: 10.0
The CVSS 3.1 vector says the attack works over the network, is easy to carry out, and needs no privileges or user interaction. It rates the impact on confidentiality, integrity and availability as High and marks the scope as changed. That means VulDB judges that a successful attack could seriously compromise the device and could affect resources beyond it.
The CVE record says the exploit "has been made public and could be used." No CISA Known Exploited Vulnerabilities (KEV) entry was supplied for this CVE, so KEV does not currently confirm active exploitation in the wild.
What's Vulnerable
The affected Qihoo 360 products run firmware versions 6.4.0 through 6.4.9:
| Product | Affected Versions |
|---|---|
| D603-2 | 6.4.0 – 6.4.9 |
| D600-2 | 6.4.0 – 6.4.9 |
| D606-6 | 6.4.0 – 6.4.9 |
| D706 | 6.4.0 – 6.4.9 |
Patch Status
The source material contains no vendor patch or advisory. The CVE description says the vendor was contacted early about the disclosure but "did not respond in any way." No CISA KEV entry was supplied, so there is no federal required action or due date.
Owners of affected devices should treat them as unpatched. Until the vendor publishes a fix, they should limit network access to the devices' management interfaces.