Threats tagged 'ghsa-rwrj-5289-458f'

A critical OS command injection vulnerability exists in Qihoo 360 devices D603-2, D600-2, D606-6, and D706 up to version 6.4.9. The flaw is in the testspeed_command function of the /fs2/bin/iscm file, allowing remote attackers to manipulate the host argument to execute arbitrary OS commands. Public exploit code is available. The vendor has not responded to disclosure requests, and no patch information is provided.