# CVE-2026-121607: Qihoo 360 Smart Camera command injection in testspeed_command

Source: https://junglewise.ai/threats/cve-2026-121607-a-vulnerability-was-found-in-qihoo-360-d603-2-d600-2-d606-6-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-121607 · Severity: critical · CVSS 10 · Published 2026-11-04

Qihoo 360 Smart Camera is a network-connected surveillance device used for home and business monitoring. A remote attacker can inject arbitrary operating system commands through a crafted speed test request delivered via the cloud push channel, allowing them to execute commands with root privileges on the camera. This could lead to complete device compromise, data theft, or use as a pivot point for further network attacks.

Technologies: [Qihoo 360 360 Smart Camera](https://junglewise.ai/threats/technologies/360-smart-camera). Vendors: [Qihoo 360](https://junglewise.ai/threats/vendors/qihoo-360).

## Quick answers

**Is CVE-2026-121607 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121607 being exploited in the wild.

**How severe is CVE-2026-121607?** Critical severity, with a CVSS score of 10, published 4 November 2026.

**Which products and versions are affected?** Qihoo 360 360 Smart Camera up to 6.4.9 (D603-2, D600-2, D606-6, D706, D618_A).

**Is there a fix for CVE-2026-121607?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-121607 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-121607?** Check whether you run Qihoo 360 360 Smart Camera at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The testspeed_command function in /fs2/bin/iscm fails to validate the "host" parameter from a JSON push message before concatenating it into a shell command passed to system_ex(). Shell metacharacters such as semicolons and pipes reach /bin/sh -c unchanged, enabling OS command injection (CWE-78). The attack requires network-level access to the push channel (plaintext HTTP) or a MITM position; no authentication is required. An attacker gains arbitrary command execution as root, with 1024 bytes of payload space sufficient for reverse shell delivery.

## Affected products

- Qihoo 360 360 Smart Camera up to 6.4.9 (D603-2, D600-2, D606-6, D706, D618_A)

## Timeline

- 2026-11-04: disclosed: Public disclosure via GitHub gist
- 2026-10-06: other: Vendor notified via security@360.cn; vendor replied instructing submission via SRC platform

## References

- [https://gist.github.com/gajgdm6-cpu/e8ef7f512bebb987b0119562873afd5a](https://gist.github.com/gajgdm6-cpu/e8ef7f512bebb987b0119562873afd5a)
- [https://vuldb.com/cve/CVE-2026-121607](https://vuldb.com/cve/CVE-2026-121607)

## Related threats

- [Qihoo 360 Smart Camera OS command injection in timezone handler](https://junglewise.ai/threats/cve-2026-121608-a-vulnerability-was-determined-in-qihoo-360-d603-2-d600-2-and)
- [Qihoo 360 Smart Camera firmware signature verification bypass](https://junglewise.ai/threats/cve-2026-121606-a-vulnerability-has-been-found-in-qihoo-360-d621-2-d603-2-d600-2)