CVE-2026-121608

A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2. This vulnerability affects the function onpushmessage of the file /fs2/bin/iscm of the component Timezone Push Handler. Executing a manipulation of the argument tz can lead to os command injection. The attack may b...

CVE-2026-121608

Qihoo 360 devices, specifically models D603-2 , D600-2 , and D606-6 running firmware versions up to 6.3.2 , are susceptible to an OS command injection vulnerability. The flaw exists within the Timezone Push Handler component, specifically in the on_push_message function of the /fs2/bin/iscm file....