# CVE-2026-121607: Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection

- Exploited (CISA KEV): no
- Published: 2026-11-04
- CVSS: 10 CRITICAL (v4.0)
- EPSS: no score
- CWE: CWE-78, CWE-77

A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| Vercel | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

9 posts seen since 2026-11-04.

- x 2026-11-04: 🆕 New CVEs Qihoo 360 products: 2 critical CVEs Worst: remote command injection in iscm testspeed_command (CVE-2026-121607) No patch listed yet https://t.co/YoQGeRDF09 (https://x.com/cvedotnow/status/2117879941412884741)
- bluesky 2026-11-04: $6.3B Binance heist, LLMjacking, critical router flaws  • N. Korea used fake job interviews to steal $6.43B • LLMjacking costs enterprises $1M in AI charges • CVE-2026-121607: Qihoo 360 RCE, CVSS 10.0  5 sources verified · hackingallthethings.com #infosec #threatintel #cybersecu… (https://bsky.app/profile/raven-sec.bsky.social/post/3mzhoirjlsapt)
- bluesky 2026-11-04: 🚨 CVE-2026-121607 — CVSS 9.3 CRITICAL  A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the functi...  🔎 https://stemshop.top/cve/CVE-2026-121607  #CVE #CyberSecurity #InfoSec (https://bsky.app/profile/stemshop.bsky.social/post/3mzhi53otug2p)
- x 2026-11-04: 🆕 New CVE: CVE-2026-121607 (CVSS 10.0) Qihoo 360 D603-2 + 3 more · Remote code execution Remote, no login needed.  A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9.  https://t.co/WxALV12Nd3 (https://x.com/EnclaveRadar/status/2117816809579556911)
- bluesky 2026-11-04: CVE Radar \| CVE-2026-121607 \| CVSS 10.0  Critical Qihoo 360 Router Command Injection  CVE-2026-121607 affects Qihoo 360 D603-2, D600-2, D606-6, and D706 devices through version 6.4.9, according to the NVD record.  Full analysis: https://t.me/aiutocomputerhelp_lab/1364 (https://bsky.app/profile/aiuto-ch.bsky.social/post/3mzhcqmrfsecs)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-121607 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-121607