What is the CVSS score of CVE-2026-53876?

CVE-2026-53876 has a CVSS 3.0 base score of 7.2 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.8%.

Which versions of RadiX AX6600 Router are affected by CVE-2026-53876?

MSI RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an authenticated OS command injection vulnerability (CVE-2026-53876, CVSS 7.2) allowing administrators with web console access to execute…

How to fix or mitigate CVE-2026-53876?

Within 24 hours: Conduct inventory of all MSI RadiX AX6600 routers in production and identify which support critical business functions; restrict web console access to named administrator accounts only. Within 7 days: Implement network segmentation to isolate administrative access (VPN or bastion host required); enable multi-factor authentication for console login; disable remote administration features; configure centralized logging of all admin activities. Within 30 days: Monitor MSI security advisories for patch release; if patch unavailable after 60 days, initiate procurement process for replacement routers from vendors with documented patch-release discipline.

RadiX AX6600 Router CVE-2026-53876

EUVD-2026-37553 HIGH

OS Command Injection (CWE-78)

2026-06-17 jpcert

Command Injection Radix Ax6600 Wifi 6 Tri Band Gaming Router

7.2

CVSS 3.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Web console is network-reachable (AV:N) and injection is straightforward once authenticated (AC:L), but administrator login is required (PR:H); root execution yields full C/I/A impact on the device only (S:U).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 06:20 vuln.today

DescriptionCVE.org

RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary command execution with the root privilege by a user who logs in to the web console as an administrator.

AnalysisAI

Authenticated OS command injection in MSI RadiX AX6600 WiFi 6 Tri-Band Gaming Router lets an administrator of the web console execute arbitrary operating system commands as root. The flaw was reported through JPCERT/JVN (JVN20769211) and carries a CVSS 3.0 score of 7.2; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The affected device is Micro-Star International's RadiX AX6600 consumer/SOHO gaming router, identified by CPE cpe:2.3:a:micro-star_international_co.,_ltd.:radix_ax6600_wifi_6_tri-band_gaming_router. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning the web management interface passes administrator-supplied input into a shell or system() style call without proper sanitization or argument separation. Because consumer router firmware typically runs web handlers as root on an embedded Linux/BusyBox userland, injected metacharacters such as ';', '|', '&&', or backticks execute with full privileges on the device.

RemediationAI

No vendor-released patch identified at time of analysis in the provided data; check the MSI RadiX AX6600 support page at https://www.msi.com/Networking/RadiX-AX6600-WiFi-6-Tri-Band-Gaming-Router/support and JVN20769211 at https://jvn.jp/en/jp/JVN20769211/ for the fixed firmware version and apply it as soon as it ships. Until a fix is available, ensure the WAN-side web administration interface is disabled (the router default for most consumer devices, but worth verifying) to remove the AV:N exposure, restrict LAN-side access to the management UI to a dedicated admin VLAN or trusted host, replace the default admin password with a strong unique credential and rotate it, and disable UPnP/remote management features that may broaden reachability - accepting that this complicates legitimate remote administration and any vendor mobile-app management flows.