CVE-2026-121608

HIGH 7.3

Qihoo 360 D603-2/D600-2/D606-6 Timezone Push iscm on_push_message os command injection

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2. This vulnerability affects the function on_push_message of the file /fs2/bin/iscm of the component Timezone Push Handler. Executing a manipulation of the argument tz can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 6.4.0 is able to resolve this issue. Upgrading the affected component is advised. Firmware 6.4.0 gates the path with a new check_timezone_parameter validation (verified by VulDB vulnerability analysis team via disassembly).

CWE	CWE-78 CWE-77
Vendor	qihoo 360
Product	d603-2
Published	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for qihoo 360 d603-2

Be the first to know when new high vulnerabilities affecting qihoo 360 d603-2 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Qihoo 360 / D603-2

6.3.0 6.3.1 6.3.2

Qihoo 360 / D600-2

6.3.0 6.3.1 6.3.2

Qihoo 360 / D606-6

6.3.0 6.3.1 6.3.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/430445 vuldb.com: https://vuldb.com/vuln/430445/cti vuldb.com: https://vuldb.com/cve/CVE-2026-121608 vuldb.com: https://vuldb.com/submit/1023263 gist.github.com: https://gist.github.com/gajgdm6-cpu/b238ba799968564773a70ad480f3e404

Credits

🔍 xiaomao (VulDB User)