CVE-2026-121607: critical command injection in Qihoo 360

CVE-2026-121607 identifies an OS command injection vulnerability in the testspeed_command function of the file /fs2/bin/iscm present in Qihoo 360 network devices models D603-2, D600-2, D606-6, and D706 up to version 6.4.9. The flaw allows a remote attacker to manipulate the host argument to execute arbitrary system commands with system privileges, achieving complete device compromise.

CVE-2026-121607 has been assigned a CVSS score of 10.0 (critical), the maximum possible value. According to official data, the exploit has been made public and is already distributed. The Qihoo 360 vendor was notified timely but provided no formal response to disclosure. The vulnerability was published on November 4, 2026 without available countermeasures.

System administrators and CISOs managing environments with affected Qihoo 360 device models must proceed with urgency: immediately verify production versions, prepare to apply security patches as soon as made available by the vendor, and in the meantime implement restricted administrative access controls and active log monitoring to detect exploitation attempts on the testspeed_command function.