MSI Radix AXE6600 CVE-2026-71985

Exploitation requires the ability to send requests to the router's web management interface and specifically reach the 'accesscontrol' function, which processes attacker-controlled input insecurely. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication or user interaction is needed - remote unauthenticated exploitation is indicated against firmware v781521. The principal limiting factor is reachability of the management interface: on default consumer deployments this is LAN-facing, so practical remote exploitation across the internet depends on WAN-side remote management being enabled or the interface otherwise being exposed; an attacker already on the local network (e.g., via Wi-Fi) meets the conditions directly.

The signals align toward high real-world severity: CVSS 4.0 base 9.3 with AV:N/AC:L/AT:N/PR:N/UI:N means no authentication, no user interaction, and low complexity, while VC:H/VI:H/VA:H reflects full compromise (root). Scope-to-subsequent metrics are N, so impact is contained to the vulnerable device itself rather than propagating to a defined downstream system. Counterbalancing the high CVSS: no EPSS score is provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no public POC is identified - so this is currently a high-capability, not-yet-widely-weaponized issue. The 'remote' claim in the description is consistent with AV:N, but for a consumer router the practical remote-attack surface depends on whether the management interface is WAN-exposed versus LAN-only; verify exposure, as many such flaws are realistically reachable only from the LAN or via CSRF-style vectors despite an AV:N rating.

An attacker with network reach to the router's management interface sends a crafted request to the 'accesscontrol' function containing shell metacharacters in an input field, causing the firmware to execute injected OS commands as root. From there they can install a persistent implant, alter DNS/firewall rules to intercept traffic, or pivot into the LAN. No public POC is identified at time of analysis, but the low attack complexity (AC:L) and lack of required authentication make weaponization straightforward once interface access is obtained.