CVE-2026-121608 Details
Description
A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2. This vulnerability affects the function on_push_message of the file /fs2/bin/iscm of the component Timezone Push Handler. Executing a manipulation of the argument tz can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 6.4.0 is able to resolve this issue. Upgrading the affected component is advised. Firmware 6.4.0 gates the path with a new check_timezone_parameter validation (verified by VulDB vulnerability analysis team via disassembly).
A command injection vulnerability has been identified in Qihoo 360 Smart Camera models D603-2, D600-2, and D606-6, running firmware versions through 6.3.2. The issue arises in the Timezone Push Handler component, specifically within the 'on_push_message' function of the '/fs2/bin/iscm' file. The vulnerability allows for OS command injection by manipulating the 'tz' argument. This exploitation can be executed remotely, with the injected command being executed with root privileges. The vulnerability has been publicly disclosed and can be exploited in the wild.
Users are advised to upgrade to version 6.4.0, which addresses the vulnerability by introducing a validation check for the 'tz' parameter in the Timezone Push Handler. This update ensures that the parameter conforms to a specified format, preventing the injection of malicious commands.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/gajgdm6-cpu/b238ba799968564773a70ad480f3e404 | [email protected] | ExploitTechnical Description |
| https://vuldb.com/cve/CVE-2026-121608 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1023263 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/430445 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/430445/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Qihoo 360 D603-2 | <= 6.3.2 (semver) |
CPE
Remediation
| |
| Qihoo 360 D600-2 | <= 6.3.2 (semver) |
CPE
Remediation
| |
| Qihoo 360 D606-6 | <= 6.3.2 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | [email protected] |