Is CVE-2026-121608 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121608 being exploited in the wild.

How severe is CVE-2026-121608?

High severity, with a CVSS score of 7.3, published 4 November 2026.

Which products and versions are affected?

Qihoo 360 360 Smart Camera up to 6.3.2.

Is there a fix for CVE-2026-121608?

Yes: fixed in 6.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121608 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-121608?

Check whether you run Qihoo 360 360 Smart Camera at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121608: Qihoo 360 Smart Camera OS command injection in timezone handler

CVE-2026-121608 · Severity: high · CVSS 7.3 · Published 2026-11-04

Qihoo 360 Smart Camera devices are used for home and business video surveillance. A vulnerability in the timezone push message handler allows an attacker with network access to inject arbitrary shell commands, leading to complete device compromise and remote code execution as root. The fix requires upgrading to firmware version 6.4.0.

Technologies: Qihoo 360 360 Smart Camera. Vendors: Qihoo 360.

Quick answers

Is CVE-2026-121608 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121608 being exploited in the wild.
How severe is CVE-2026-121608?: High severity, with a CVSS score of 7.3, published 4 November 2026.
Which products and versions are affected?: Qihoo 360 360 Smart Camera up to 6.3.2.
Is there a fix for CVE-2026-121608?: Yes: fixed in 6.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121608 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-121608?: Check whether you run Qihoo 360 360 Smart Camera at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.4.0

Technical details

The on_push_message function in /fs2/bin/iscm validates the tz parameter only for length (exactly 6 bytes) and first character (+ or -), then directly passes it to a shell command via sprintf/system without sanitizing characters 1–5. An attacker can inject shell metacharacters within the 6-byte constraint (e.g., "-;id;#") to execute arbitrary commands. The vulnerability requires network MITM position or control of the push channel, and the fix in 6.4.0 adds strict pattern validation ([+-][0-9]{2}:[0-9]{2}).

Affected products

Qihoo 360 360 Smart Camera up to 6.3.2

Timeline

2026-11-04: disclosed
2026: patched: Version 6.4.0 released with check_timezone_parameter validation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.