CVE-2026-121607

Name of the Vulnerable Software and Affected Versions Qihoo 360 D603-2 versions prior to 6.4.9 Qihoo 360 D600-2 versions prior to 6.4.9 Qihoo 360 D606-6 versions prior to 6.4.9 Qihoo 360 D706 versions prior to 6.4.9

Description An OS command injection flaw exists in the testspeed command() function within the /fs2/bin/iscm file. A remote attacker can trigger this issue by manipulating the host argument, allowing for the execution of arbitrary operating system commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.