MSI Radix AXE6600 CVE-2026-71987

Exploitation requires network reachability of the router's 'alg' (application-layer gateway) function and that the vulnerable v781521 firmware is running; per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication, no special access, and no user interaction are needed against a reachable, vulnerable device. The main limiting factor is exposure: on a consumer router the ALG service is typically LAN-facing by default, so WAN/internet exploitation depends on the device having remote management or the affected service exposed to untrusted networks; the ALG feature must also be active for the vulnerable code path to be reachable, so disabling it (where possible) removes the attack surface.

All available signals point to genuine high priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes remote, unauthenticated, low-complexity exploitation with no user interaction and full confidentiality, integrity, and availability impact on the vulnerable system - the maximum realistic risk profile for a network device, and consistent with the description's claim of remote arbitrary command execution as root. Tempering that raw score: no EPSS probability was supplied, the CVE is not in CISA KEV (so no confirmed active exploitation), and no public POC is referenced, so the current exploitation likelihood is unquantified. The primary real-world limiter is exposure - exploitation requires network reachability of the vulnerable ALG service, which on a home/gaming router is typically LAN-facing by default unless remote management or an internet-exposed service surfaces it to the WAN. Net: a critical-severity flaw whose blast radius depends heavily on whether the device is exposed to untrusted networks.

An attacker who can reach the router's ALG service - for example a malicious device on the LAN, or the internet if remote management/WAN services expose it - sends a crafted request whose fields carry embedded shell metacharacters that the 'alg' function passes to a system shell. The injected command runs as root, letting the attacker plant a backdoor, capture or reroute traffic, and take persistent control of the router. No authentication or user interaction is required (PR:N/UI:N), though no public POC has been identified at time of analysis.