Qihoo 360 D603-2 CVE-2026-121608

The target must be a Qihoo 360 D603-2, D600-2, or D606-6 running firmware at or below 6.3.2, which lacks the check_timezone_parameter validation introduced in 6.4.0. Exploitation requires the attacker to deliver a push message whose tz argument reaches the on_push_message function in /fs2/bin/iscm (the Timezone Push Handler); shell metacharacters in that argument are then executed as OS commands. LIMITING FACTORS: only the three listed router models at/below 6.3.2 are affected, and the attacker must be able to reach the device's timezone push channel - the delivery path and whether that channel requires any cloud/account authentication are not described in the available sources, so the stated PR:N reachability is not independently confirmed.

Signals point to a real but non-emergency issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity flaw with no authentication or user interaction, and exploit maturity is flagged E:P (proof-of-concept). The vuln.today priority is 'this_month', not act_now or emergency, and there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation. A public PoC reference exists but is not verified as working exploit code, so exploitability should be treated as plausible rather than proven. Note a tension in the impact rating: VulDB scored impact as low across the board (VC:L/VI:L/VA:L) and the overall score 6.9, yet the flaw is OS command injection (CWE-78), a class that normally yields full arbitrary command execution - the privilege level of the /fs2/bin/iscm process is not stated in the sources, so the low impact rating cannot be independently reconciled and should be verified. Combined with a narrow, niche affected product set, this is a 'patch on a normal cycle' item rather than a drop-everything priority.

A remote attacker who can deliver a crafted timezone push message to an affected Qihoo 360 router (D603-2, D600-2, D606-6 at or below 6.3.2) embeds shell metacharacters in the tz argument, which is processed by the on_push_message function in /fs2/bin/iscm without validation, resulting in OS command injection. A public PoC reference exists but is not verified as working exploit code. CVSS indicates low attack complexity and no required privileges, though the sources do not describe how the push channel is reached.