CVE-2026-121607 in D603-2
Summary
by MITRE • 11/04/2026
A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in Qihoo 360 D603-2, D600-2, D606-6, and D706 devices running firmware versions up to 6.4.9 represents a critical security flaw within the network management subsystem of these routers. Specifically, the defect resides in the testspeed_command function located within the binary file /fs2/bin/iscm. This component is responsible for executing speed test operations, which are commonly used by users and administrators to verify internet connection quality. The core technical issue stems from improper input validation when handling the host argument passed to this command execution routine. Because the application fails to adequately sanitize or escape user-supplied data before incorporating it into a system-level shell command string, an attacker can inject arbitrary operating system commands through carefully crafted inputs. This class of flaw is formally categorized under CWE-78, which defines Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection.
The operational impact of this vulnerability is severe due to its remote exploitable nature and the high privileges typically held by network management daemons on embedded devices like routers. An attacker can initiate a remote attack without requiring prior authentication or physical access to the device, provided they have network connectivity to the affected service endpoint. By manipulating the host parameter during a speed test request, an adversary can achieve arbitrary code execution with the same permissions as the iscm process. In many router architectures, such processes run with root privileges, meaning successful exploitation grants the attacker full control over the underlying operating system. This level of access allows for comprehensive compromise of the device, including reading sensitive configuration files, installing persistent backdoors, pivoting to other devices on the local network, or using the compromised router as a launchpad for attacks against external targets. The fact that an exploit has already been made public significantly increases the risk landscape, as automated scanning tools and malicious actors can readily leverage this knowledge to target vulnerable instances across the internet.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically T1059, where adversaries use system commands to execute actions on compromised hosts. The lack of vendor response further exacerbates the risk profile for organizations relying on these devices. Without an official patch or mitigation guidance from Qihoo 360, administrators are left with limited options to remediate the issue directly through firmware updates. Consequently, defensive strategies must focus on network-level controls and segmentation. It is advisable to restrict access to the management interfaces of these routers by implementing strict firewall rules that limit connectivity to trusted IP addresses only. Additionally, disabling unnecessary services such as remote speed testing if not required can reduce the attack surface. For environments where immediate patching is impossible, deploying intrusion detection systems with signatures targeting this specific command injection pattern may provide an additional layer of monitoring and alerting capability until a vendor-supplied fix becomes available or alternative hardware solutions are procured.