AI analysis
Claude Opus · 7 Nov 2026, 10:21 CET
Qihoo 360 D603-2, D600-2, D606-6 and D706 firmware open to remote command injection
Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9 contain an unauthenticated, remotely reachable OS command injection rated CVSS 3.1 10.0. A public exploit exists and no vendor fix is listed, so restrict network access to affected devices now.
In plain terms
Several Qihoo 360 products, the D603-2, D600-2, D606-6 and D706, contain a flaw in software versions up to 6.4.9. A built-in program that handles a speed test feature takes a value called "host" and passes it to the device's operating system without checking it properly. This is called command injection: an attacker slips their own instructions into a value the device trusts, and the device runs them.
According to the record, this can be triggered remotely, without a login and without anyone clicking anything. Someone who succeeds could effectively take control of the device. Anyone who owns or manages these Qihoo 360 models, whether at home or in an organisation, should care, especially because the vendor has not responded and no fix is listed.