Threats tagged 'ghsa-pw8g-mg6x-g4wh'

A command injection vulnerability exists in Qihoo 360 D603-2, D600-2, and D606-6 devices up to version 6.3.2. The flaw is in the on_push_message function of the /fs2/bin/iscm component's Timezone Push Handler, where manipulation of the tz argument can lead to remote OS command injection. This vulnerability has a CVSS score of 7.3 (high severity). The issue is resolved by upgrading to version 6.4.0, which implements a validation check for the timezone parameter.