EUVD-2026-116671Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device service interface over network
-
DeliverySubmit crafted value in host argument
-
ExploitTrigger OS command injection in testspeed_command (/fs2/bin/iscm)
-
ExecutionExecute arbitrary shell commands as the device process
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the service/management interface that invokes the testspeed_command function in /fs2/bin/iscm, and the ability to control the host argument passed to that function (the injection point) on an affected Qihoo 360 D-series device (D603-2, D600-2, D606-6, D706 at firmware 6.4.0 through 6.4.9). The supplied CVSS vector states PR:N (no authentication), but the description does not describe the trigger path or any authentication requirement, so whether the speed-test function is reachable pre-authentication versus behind an admin session is not confirmed from available sources. Realistic exposure is limited by whether the device's management interface is reachable by the attacker (e.g., LAN-only versus internet-exposed); no user interaction is required per the vector. |
| Impact | Multiple signals align toward high real-world risk. The CWE-78 OS command injection reaches full compromise of the device (CVSS 4.0 VC:H/VI:H/VA:H, score 9.3) and the provided vector is AV:N/AC:L/AT:N/PR:N/UI:N - network-reachable, low complexity, no attack requirements, and no privileges per the supplied metrics. The vuln.today Decision label is act_now and a public PoC reference is cited, so this should be treated as a priority rather than a high-CVSS-but-low-impact issue. However, several signals are missing or weak and must temper that: there is no KEV listing (not confirmed actively exploited), no EPSS probability was provided, and the PoC is a reference only, not verified as working exploit code. The PR:N rating is also worth scrutiny - the affected function sits in a device binary (/fs2/bin/iscm) and such speed-test/management features on embedded gateways are frequently behind an authenticated admin interface, but the description gives no authentication detail, so the unauthenticated claim rests solely on the supplied CVSS vector and is not independently corroborated. The vendor was contacted but did not respond, so no official fix or confirmation exists. |
| Exploit ScenarioDerived | An attacker who can reach the management/service interface of an affected Qihoo 360 D-series device sends a request that supplies a malicious value in the host argument handled by the testspeed_command function in /fs2/bin/iscm, causing the supplied shell metacharacters to be executed by the underlying OS. Because the supplied CVSS vector is AV:N/AC:L/PR:N/UI:N, exploitation is remote and low-complexity in that model. A public PoC reference exists (a GitHub gist); it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Nov 04, 2026
OS command injection in the testspeed_command function of /fs2/bin/iscm on Qihoo 360 D-series networking devices (D603-2, D600-2, D606-6, D706) running firmware 6.4.0 through 6.4.9 lets an attacker who can reach the speed-test functionality and control the 'host' argument execute arbitrary commands on the device, with high impact to confidentiality, integrity and availability as well as follow-on systems. The supplied CVSS 4.0 vector is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N with all impact metrics High) and our assessment concurs on network reachability and total impact, though the sources do not describe the trigger path, so whether the function is reachable pre-authentication or only behind an administrative session is not confirmed. A public PoC reference exists; it is not verified as working exploit code, there is no CISA KEV entry, and the vendor was contacted but did not respond, so no fixed firmware version is identified - the vuln.today decision label is act_now, so treat exposed management interfaces as urgent.
Earlier versions of this analysis (1)
Unauthenticated remote OS command injection in Qihoo 360 router firmware up to and including 6.4.9 (models D603-2, D600-2, D606-6 and D706) lets any attacker who can reach the iscm service pass a crafted host argument to testspeed_command and have it executed as an operating system command. The supplied CVSS 4.0 score is 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with High impact on confidentiality, integrity and availability of both the device and subsequent systems), and the vuln.today decision label is act_now, so the exposure is treated as maximum severity. A public PoC reference exists on a GitHub gist; it is not verified as working exploit code, and the vendor was contacted about the disclosure but did not respond.
RemediationAI
No vendor-released patch was identified at the time of analysis: the vendor was contacted about the disclosure and did not respond, and the references contain only the VulDB records (https://vuldb.com/vuln/430444, https://vuldb.com/vuln/430444/cti, https://vuldb.com/cve/CVE-2026-121607) and a public PoC gist (https://gist.github.com/gajgdm6-cpu/e8ef7f512bebb987b0119562873afd5a) with no fixed firmware version, so operators of D603-2, D600-2, D606-6 or D706 units on 6.4.0-6.4.9 must rely on compensating controls until the vendor ships a fix. Until then, restrict reachability of the management/diagnostic interface that invokes the iscm testspeed_command function - place device management on a dedicated, access-controlled VLAN, block it at the perimeter so the interface is not internet-exposed, and allow only trusted administrative source addresses - accepting that this limits remote troubleshooting and central management; disable or avoid using the built-in speed-test feature where the product allows it, at the cost of losing that diagnostic capability; and monitor device logs and outbound traffic from the appliance for unexpected shell-spawned processes or connections originating from the management plane. Confirming the vendor's response status and monitoring https://vuldb.com/vuln/430444 for an updated fixed firmware version is advised given the act_now priority label.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-78 OS command injection: the testspeed_command routine inside the device binary /fs2/bin/iscm takes a caller-supplied 'host' value - presumably the target of a link speed test - and passes it into a shell context without adequate neutralization, so shell metacharacters in that argument become commands executed with the privileges of the iscm process on the appliance. CPE data pins the affected platform to four Qihoo 360 D-series models (d603-2, d600-2, d606-6, d706), and EUVD enumerates every firmware release from 6.4.0 through 6.4.9 for each model as affected, which is consistent with a long-lived code path rather than a regression in a single build. Because the vulnerable logic sits in a network-facing management/diagnostic function, exploitation requires the attacker to reach the interface that invokes it and to influence the host argument; the sources do not document the exact HTTP/CLI request, authentication state, or privilege level needed to reach that call. The CVSS 4.0 vector's PR:N suggests no authentication, but that is a scored assumption rather than a documented precondition, and our assessed 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) agrees on severity while leaving the pre-auth versus post-auth question open.
Know when D706 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
OS command injection yielding full device control, network-reachable and low-complexity per the supplied vector; PR:N retained from input though auth gating is unverified, scope unchanged as code runs within the device context.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
A critical OS command injection vulnerability (CVSS 9.3) affects Qihoo 360 D-series networking devices running firmware 6.4.0 through 6.4.9, allowing attackers with network access to potentially execute arbitrary commands. Although exploitation status is unconfirmed, the high impact on confidentiality, integrity, and availability-plus potential lateral movement-demands immediate leadership attention to protect organizational assets and data.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to the speed-test functionality (e.g., via firewall rules or ACLs), segmenting affected devices from critical systems, monitoring for anomalous command execution, and considering replacement with supported devices if risk cannot be adequately mitigated.
Threat Intelligence Overview
NVD
CVE.org
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB