Which versions of MSI Radix AXE6600 are affected by CVE-2026-71987?

The MSI Radix AXE6600 WiFi 6E gaming router (firmware v781521) contains a critical unauthenticated remote code execution vulnerability allowing attackers to gain complete control of affected devices…. A patch is available.

How to fix or mitigate CVE-2026-71987?

Within 24 hours, identify all MSI Radix AXE6600 routers deployed in your network environment and prioritize those in security-critical locations such as office networks, guest networks, and remote access points. Concurrently, contact MSI support or check their security advisory to obtain the patched firmware version and begin lab testing to validate compatibility with your network environment. Within 7 days, deploy the patched firmware across all identified vulnerable units in non-production networks first, monitor for compatibility issues, and maintain an accurate inventory of pre-patch firmware versions. Within 30 days, apply the vendor-released patch to all remaining MSI Radix AXE6600 units in your production environment and verify successful updates through firmware version validation and active security scanning of affected network segments.

MSI Radix AXE6600 CVE-2026-71987

Q: What is the CVSS score of CVE-2026-71987?

CVE-2026-71987 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.4%.

EUVD-2026-54830 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-93pc-gm98-jcfp

Command Injection Radix Axe6600 Msi

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote unauthenticated command injection with no user interaction (AV:N/AC:L/PR:N/UI:N) yielding root, so full C/I/A impact; scope unchanged as the command runs on the same device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 09, 2026 - 00:01 vuln.today

CVE Published

Aug 08, 2026 - 23:27 cve.org

CRITICAL 9.3

DescriptionCVE.org

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the alg function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.

AnalysisAI

OS command injection in the MSI Radix AXE6600 WiFi 6E gaming router (firmware v781521) allows remote attackers to inject and execute arbitrary shell commands via the router's 'alg' (application-layer gateway) function, yielding full root privileges on the device. The CVSS 4.0 base score is 9.3 (Critical) with a fully remote, unauthenticated, low-complexity vector, and a vendor patch is available; however, no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The flaw is a classic OS command injection (CWE-78): attacker-controlled input reaches an underlying shell/system call within the router's 'alg' function without proper neutralization of shell metacharacters. ALG (Application-Layer Gateway) components in consumer routers typically inspect and rewrite traffic for protocols such as SIP, FTP, or PPTP that embed IP/port information in their payloads; if such a handler passes untrusted values into a system() or popen()-style call (common on embedded BusyBox/Linux firmware running services as root), an attacker can append or substitute arbitrary commands. The affected component is identified in the CPE string cpe:2.3:a:msi:radix_axe6600:*:*:*:*:*:*:*:* and is confirmed to the specific firmware build v781521.

RemediationAI

Patch available per vendor advisory: apply the latest firmware for the Radix AXE6600 from the MSI support page (https://us.msi.com/Networking/RadiX-AXE6600-WiFi-6E-Tri-Band-Gaming-Router/support); an exact fixed firmware version was not stated in the provided data, so verify the specific patched build on that page and against the VulnCheck advisory (https://www.vulncheck.com/advisories/msi-radix-axe6600-v781521-command-injection-via-alg-function) before deployment. Until patched, disable remote/WAN management so the administrative and ALG services are not reachable from the internet (trade-off: loss of off-network administration), and disable the ALG feature(s) in the router settings if the exploited handler can be turned off (trade-off: some NAT-traversal protocols such as SIP/FTP/PPTP passthrough may break). Additionally restrict access to the device's management and service interfaces to trusted LAN hosts and segment the router's admin plane away from untrusted or guest networks.