Which versions of MSI Radix AXE6600 are affected by CVE-2026-71984?

A critical remote command injection vulnerability (CVE-2026-71984, CVSS 9.3) in the MSI Radix AXE6600 WiFi 6E gaming router permits unauthenticated attackers on the network to inject arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-71984?

Within 24 hours, identify all MSI Radix AXE6600 routers running firmware v781521 across the network and isolate any non-critical instances from production segments until patching completes. Within 7 days, implement network segmentation to restrict trust access to the device, monitor the router's urlfilter function logs for suspicious command-injection patterns containing shell metacharacters, and disable the urlfilter function if operationally feasible as a temporary mitigation. Within 30 days, deploy the vendor-released patch to all identified units, verify successful firmware updates through MSI's support advisory, and conduct network-wide scans for indicators of compromise during the vulnerability window.

MSI Radix AXE6600 CVE-2026-71984

Q: What is the CVSS score of CVE-2026-71984?

CVE-2026-71984 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.4%.

EUVD-2026-54827 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-ccp8-mcj2-r8fv

Command Injection Radix Axe6600 Msi

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable command injection (AV:N/AC:L/PR:N/UI:N) yielding root gives full C/I/A impact; scope unchanged as execution stays within the device OS.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 09, 2026 - 00:00 vuln.today

CVE Published

Aug 08, 2026 - 23:16 cve.org

CRITICAL 9.3

DescriptionCVE.org

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the urlfilter function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the urlfilter function to inject malicious commands and obtain root privileges on the underlying system.

AnalysisAI

Remote command injection in the MSI Radix AXE6600 WiFi 6E gaming router (firmware v781521) lets network-reachable attackers inject arbitrary OS commands through the router's urlfilter function and gain root on the device. The flaw (CWE-78) is unauthenticated per the CVSS 4.0 vector and was reported by VulnCheck; no public exploit identified at time of analysis, though full device takeover is the demonstrated impact. A vendor patch is available per the MSI support advisory.

Technical ContextAI

The affected component is the urlfilter function in MSI's Radix AXE6600 router firmware - a URL-filtering/parental-control feature typical of consumer/prosumer WiFi routers, which passes user-supplied input into an underlying shell or system() call on the embedded Linux platform. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): the urlfilter handler fails to sanitize or escape shell metacharacters before incorporating attacker-controlled data into a command executed by the router's OS. The single affected CPE, cpe:2.3:a:msi:radix_axe6600, confirms the vulnerability is scoped to the AXE6600 firmware application layer, and because router web/management daemons commonly run as root, successful injection yields full root-level command execution on the device.

RemediationAI

Patch available per vendor advisory - apply the firmware update offered by MSI on the RadiX AXE6600 support page (https://us.msi.com/Networking/RadiX-AXE6600-WiFi-6E-Tri-Band-Gaming-Router/support); no exact fixed firmware version was provided in the input, so verify the specific patched build against MSI's release notes before deployment. Until the update is applied, reduce exposure by ensuring the router's web/management interface and any remote-administration feature are not reachable from the WAN (disable remote management), restricting access to the management interface to a trusted admin VLAN or a small set of admin hosts, and avoiding use of the urlfilter/URL-filtering feature where practical - noting the trade-off that disabling URL filtering removes any parental-control/content-filtering protection it provided. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/msi-radix-axe6600-v781521-command-injection-via-urlfilter) for detailed technical guidance.