External risk intelligence

Qihoo 360 Router OS Command Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-121607

The affected products are Qihoo 360 routers. These devices are network appliances typically positioned at the network perimeter or acting as gateways for home or small office networks. As internet-facing edge devices that manage network traffic, they are commonly exposed to the public internet by design in normal deployment scenarios.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A remote command injection vulnerability exists in certain Qihoo 360 router models, allowing an unauthenticated attacker to execute arbitrary commands on the device. This issue stems from improper handling of user-supplied input within a function test speed command. The exploit is publicly available, and the vendor has not responded to disclosures.

Remote attackers can run commands on affected routers.
Exploit is public; confirm if these routers are in your environment.
Vulnerability requires immediate assessment for exposure.

Attack Path

How an attacker could exploit the issue

An attacker can initiate a remote attack by manipulating a specific argument in the `testsneed_command` function, which is part of the `iscm` executable. This manipulation allows them to inject operating system commands, potentially leading to significant compromise. The exploit is publicly available, increasing the risk of its use.

Entry condition: Unauthenticated network access.
Trigger point: Manipulating the `host` argument.
Resulting risk: Remote command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary commands on the affected system. The attack vector targets a specific command-line argument manipulation, potentially leading to unauthorized system access and control when the device is exposed to the internet.

System command execution.
Remote manipulation of arguments.
Unauthorized system access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vendor for Qihoo 360 routers has not responded to disclosure, indicating potential challenges in obtaining vendor-provided fixes. System owners or infrastructure teams are likely responsible for identifying affected devices, assessing their business criticality and exposure, and then coordinating remediation. Initial steps should focus on inventorying all Qihoo 360 D603-2, D600-2, D606-6, and D706 devices, confirming their network reachability, and identifying the accountable technical owner.

Own the issue, coordinate with the vendor.
Verify device inventory and network exposure.
Plan remediation during a maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Qihoo 360 D603-2 and related router series?

These are networking devices designed by Qihoo 360 to manage internet connectivity for homes or small offices. They act as gateways, handling traffic routing and security functions. Models like the D603-2, D600-2, D606-6, and D706 are central to network infrastructure, as they facilitate the connection between internal local networks and the public internet.

What does CVE-2026-121607 mean for these routers?

This vulnerability is an OS command injection, classified under CWE-77 and CWE-78. Essentially, it means the router's software fails to filter input properly. An attacker can use this flaw to trick the device into running unauthorized system-level commands, allowing them to manipulate the router's operating system as if they were a legitimate administrator.

How can an attacker trigger this vulnerability?

The attack occurs by sending a specifically crafted request to the 'testspeed_command' function within the 'iscm' system file. By manipulating the 'host' argument in this request, an unauthorized user can inject commands. The vulnerability is not triggered by normal speed testing activity, but rather by malicious interaction with these specific technical parameters.

Why should I be concerned about my network exposure?

Halo Surface Signal indicates that these devices are commonly used as internet-facing gateways. Because the vulnerability is remotely exploitable, a router directly reachable from the public internet is at a higher risk of being targeted. If your device handles incoming traffic directly, it lacks the protection of an upstream firewall, making it more accessible to remote attackers.

What are the first steps to address this issue?

Since the vendor has not provided a patch, focus on discovery and isolation. Begin by creating a full inventory of all affected models in your environment to determine where they are deployed. Assess if these devices can be placed behind additional security controls or restricted to internal access only. Identify the technical owners responsible for these systems to plan for long-term mitigation or potential hardware replacement.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.