CVE-2026-121608 in D603-2
Summary
by MITRE • 11/04/2026
A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2. This vulnerability affects the function on_push_message of the file /fs2/bin/iscm of the component Timezone Push Handler. Executing a manipulation of the argument tz can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 6.4.0 is able to resolve this issue. Upgrading the affected component is advised. Firmware 6.4.0 gates the path with a new check_timezone_parameter validation (verified by VulDB vulnerability analysis team via disassembly).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The identified security flaw resides within the Timezone Push Handler component of Qihoo 360 D603-2, D600-2, and D606-6 devices running firmware versions up to 6.3.2. Specifically, the vulnerability is located in the on_push_message function found in the /fs2/bin/iscm binary file. This component is responsible for handling push notifications related to timezone configurations, a critical feature for maintaining accurate time synchronization across networked devices. The core technical issue stems from improper input validation of the tz argument passed into this function. When an attacker manipulates this parameter with specially crafted data containing shell metacharacters or command separators, the application fails to sanitize the input before passing it to underlying operating system commands. This lack of sanitization allows for OS command injection, a severe vulnerability class where untrusted user input is executed as part of a system-level command string without adequate restrictions.
From an operational perspective, this flaw enables remote code execution with potentially elevated privileges depending on the context in which the iSCM process runs. Since the attack vector is remote, an adversary does not need physical access or prior authentication to exploit this weakness if the relevant network ports are exposed and accessible from untrusted networks. The public disclosure of exploits for this vulnerability significantly increases the risk landscape, as malicious actors can readily leverage existing proof-of-concept code to compromise affected devices. Successful exploitation could lead to a complete takeover of the device, allowing attackers to install malware, pivot into internal networks, exfiltrate sensitive data, or disrupt critical services that rely on accurate time synchronization and system integrity.
This vulnerability aligns with CWE-78, which describes Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The attack technique is consistent with MITRE ATT&CK T1059, specifically sub-techniques involving command and script interpreters such as sh or bash. The ability to execute arbitrary commands remotely places this vulnerability among the most critical threats for IoT and embedded systems, where secure update mechanisms are often less robust than those in traditional enterprise software environments.
To mitigate this risk, immediate action is required by upgrading all affected devices to version 6.4.0 or later. This updated firmware introduces a new validation function named check_timezone_parameter within the iSCM binary. Analysis of the patched code confirms that this new routine properly gates and validates the path parameters before they are processed, effectively neutralizing the injection vector. Organizations managing fleets of these devices should prioritize patching to close this remote execution gap until all endpoints have been updated to a secure version.