D600 2
Monthly
OS command injection in the testspeed_command function of /fs2/bin/iscm on Qihoo 360 D-series networking devices (D603-2, D600-2, D606-6, D706) running firmware 6.4.0 through 6.4.9 lets an attacker who can reach the speed-test functionality and control the 'host' argument execute arbitrary commands on the device, with high impact to confidentiality, integrity and availability as well as follow-on systems. The supplied CVSS 4.0 vector is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N with all impact metrics High) and our assessment concurs on network reachability and total impact, though the sources do not describe the trigger path, so whether the function is reachable pre-authentication or only behind an administrative session is not confirmed. A public PoC reference exists; it is not verified as working exploit code, there is no CISA KEV entry, and the vendor was contacted but did not respond, so no fixed firmware version is identified - the vuln.today decision label is act_now, so treat exposed management interfaces as urgent.
Qihoo 360 router firmware through 6.4.9 contains an improper cryptographic signature verification flaw in the verify_sign function of fs2/bin/iscm, within the Firmware Signature Verification component on models D621-2, D603-2, D600-2, D619, D606-6 and D706. Manipulating the sign argument can cause a signature to be accepted when it should be rejected, giving a network-reachable, unauthenticated attacker potential high confidentiality, integrity and availability impact per the CVSS vector, although the exact network-facing trigger is not described in the available sources. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV confirmation is provided, and no fixed firmware version is published, so the act_now priority rests largely on a single source.
OS command injection in the Qihoo 360 D603-2, D600-2 and D606-6 router firmware at or below 6.3.2 allows remote attackers to run arbitrary shell commands on the device by supplying shell metacharacters in the tz argument handled by on_push_message in /fs2/bin/iscm. Only those three models on firmware up to 6.3.2 lack the check_timezone_parameter validation added in 6.4.0, and while the assessed vector is unauthenticated, the push-message delivery path and whether it requires cloud/account authentication are not described in the available sources, so that reachability is not independently confirmed. There is no CISA KEV listing, but a public PoC reference exists; it is not verified as working exploit code. The vendor-released patch is firmware 6.4.0.
OS command injection in the testspeed_command function of /fs2/bin/iscm on Qihoo 360 D-series networking devices (D603-2, D600-2, D606-6, D706) running firmware 6.4.0 through 6.4.9 lets an attacker who can reach the speed-test functionality and control the 'host' argument execute arbitrary commands on the device, with high impact to confidentiality, integrity and availability as well as follow-on systems. The supplied CVSS 4.0 vector is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N with all impact metrics High) and our assessment concurs on network reachability and total impact, though the sources do not describe the trigger path, so whether the function is reachable pre-authentication or only behind an administrative session is not confirmed. A public PoC reference exists; it is not verified as working exploit code, there is no CISA KEV entry, and the vendor was contacted but did not respond, so no fixed firmware version is identified - the vuln.today decision label is act_now, so treat exposed management interfaces as urgent.
Qihoo 360 router firmware through 6.4.9 contains an improper cryptographic signature verification flaw in the verify_sign function of fs2/bin/iscm, within the Firmware Signature Verification component on models D621-2, D603-2, D600-2, D619, D606-6 and D706. Manipulating the sign argument can cause a signature to be accepted when it should be rejected, giving a network-reachable, unauthenticated attacker potential high confidentiality, integrity and availability impact per the CVSS vector, although the exact network-facing trigger is not described in the available sources. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV confirmation is provided, and no fixed firmware version is published, so the act_now priority rests largely on a single source.
OS command injection in the Qihoo 360 D603-2, D600-2 and D606-6 router firmware at or below 6.3.2 allows remote attackers to run arbitrary shell commands on the device by supplying shell metacharacters in the tz argument handled by on_push_message in /fs2/bin/iscm. Only those three models on firmware up to 6.3.2 lack the check_timezone_parameter validation added in 6.4.0, and while the assessed vector is unauthenticated, the push-message delivery path and whether it requires cloud/account authentication are not described in the available sources, so that reachability is not independently confirmed. There is no CISA KEV listing, but a public PoC reference exists; it is not verified as working exploit code. The vendor-released patch is firmware 6.4.0.