MSI Radix AXE6600 CVE-2026-71986

Exploitation requires network reachability to the MSI Radix AXE6600 management/web interface and the ability to invoke the dmz configuration function on firmware v781521, supplying shell metacharacters in the DMZ host parameter. The vendor vector marks this AV:N/AC:L/PR:N/UI:N (remote, low complexity, no privileges, no user interaction), but because the dmz function is an administrative configuration feature it realistically presumes access to the admin panel - either authenticated, via default/weak credentials, or through a management interface exposed to an untrusted network. Limiting factors that reduce real-world exposure: routers with remote management disabled restrict the attack surface to the LAN, non-default admin credentials raise the bar to authenticated access, and only the specific firmware build v781521 is confirmed affected. Whether the dmz endpoint is reachable pre-authentication is not confirmed by the available data.

The signals are largely aligned toward high severity but not maximum urgency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with full VC/VI/VA:H yields 9.3, implying trivial remote unauthenticated exploitation, and CWE-78 command injection to root is inherently high-impact and often automatable. However, the dmz function is an administrative configuration feature, so real-world exploitation most likely requires access to the router's management interface (authenticated admin, or an unauthenticated path only if the panel is WAN-exposed or protected by default credentials) - a nuance the PR:N rating understates and defenders should verify. Tempering the priority: this CVE is NOT in CISA KEV, no EPSS score was provided in the input, and no public proof-of-concept was identified, so there is no evidence of active or widespread exploitation yet. That said, router command-injection bugs are frequently weaponized into botnets once details circulate, so even a mid-sized municipal IT team in gliwice running a fleet of these on branch offices should treat this as urgent if any unit exposes its admin interface to untrusted networks. Net assessment: genuinely high real-world risk where the management plane is reachable, materially lower where it is restricted to a trusted LAN.

An attacker who can reach the router's web administration interface - for example on a device with remote management enabled or exposed to the LAN - submits a crafted DMZ host value containing shell metacharacters into the dmz configuration function. The injected command executes as root, letting the attacker plant a backdoor, pivot into the internal network, or enroll the device in a botnet. No public proof-of-concept was identified at time of analysis, but the low attack complexity makes reliable exploitation straightforward once the endpoint is reachable.