Is CVE-2026-121607 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121607 being exploited in the wild.

How severe is CVE-2026-121607?

Critical severity, with a CVSS score of 10, published 4 November 2026.

Which products and versions are affected?

Qihoo 360 360 Smart Camera up to 6.4.9 (D603-2, D600-2, D606-6, D706, D618_A).

Is there a fix for CVE-2026-121607?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-121607 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-121607?

Check whether you run Qihoo 360 360 Smart Camera at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121607: Qihoo 360 Smart Camera command injection in testspeed_command

CVE-2026-121607 · Severity: critical · CVSS 10 · Published 2026-11-04

Qihoo 360 Smart Camera is a network-connected surveillance device used for home and business monitoring. A remote attacker can inject arbitrary operating system commands through a crafted speed test request delivered via the cloud push channel, allowing them to execute commands with root privileges on the camera. This could lead to complete device compromise, data theft, or use as a pivot point for further network attacks.

Technologies: Qihoo 360 360 Smart Camera. Vendors: Qihoo 360.

Quick answers

Is CVE-2026-121607 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121607 being exploited in the wild.
How severe is CVE-2026-121607?: Critical severity, with a CVSS score of 10, published 4 November 2026.
Which products and versions are affected?: Qihoo 360 360 Smart Camera up to 6.4.9 (D603-2, D600-2, D606-6, D706, D618_A).
Is there a fix for CVE-2026-121607?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-121607 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-121607?: Check whether you run Qihoo 360 360 Smart Camera at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The testspeed_command function in /fs2/bin/iscm fails to validate the "host" parameter from a JSON push message before concatenating it into a shell command passed to system_ex(). Shell metacharacters such as semicolons and pipes reach /bin/sh -c unchanged, enabling OS command injection (CWE-78). The attack requires network-level access to the push channel (plaintext HTTP) or a MITM position; no authentication is required. An attacker gains arbitrary command execution as root, with 1024 bytes of payload space sufficient for reverse shell delivery.

Affected products

Qihoo 360 360 Smart Camera up to 6.4.9 (D603-2, D600-2, D606-6, D706, D618_A)

Timeline

2026-11-04: disclosed: Public disclosure via GitHub gist
2026-10-06: other: Vendor notified via security@360.cn; vendor replied instructing submission via SRC platform

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.