Which versions of MSI Radix AXE6600 are affected by CVE-2026-71988?

The MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) is affected by CVE-2026-71988, a critical remote command injection vulnerability (CVSS 9.3) that enables attackers to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-71988?

Within 24 hours, identify and catalog all MSI Radix AXE6600 Wi-Fi 6E routers deployed in the network, particularly those in security-sensitive segments or Internet-facing locations. Within 7 days, procure and deploy the vendor patch from MSI support advisory to all affected devices, with priority given to those supporting critical business functions or positioned on untrusted network perimeters. Within 30 days, verify patch deployment across the fleet, document remediation completion for audit and compliance purposes, and review router administrative access controls to enforce least-privilege network management practices.

MSI Radix AXE6600 CVE-2026-71988

Q: What is the CVSS score of CVE-2026-71988?

CVE-2026-71988 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.4%.

EUVD-2026-54831 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-g9v7-jqrr-7mmp

Command Injection Radix Axe6600 Msi

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network command injection (AV:N/AC:L/PR:N/UI:N) yielding root code execution gives full C/I/A High; scope Unchanged as impact stays within the device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 09, 2026 - 00:02 vuln.today

CVE Published

Aug 08, 2026 - 23:31 cve.org

CRITICAL 9.3

DescriptionCVE.org

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the portFw function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.

AnalysisAI

Remote command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers run arbitrary OS commands as root by abusing the portFw port-forwarding function, reachable through the alg handler. The flaw was reported by VulnCheck and carries a critical CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV. A vendor patch is available per the MSI support advisory.

Technical ContextAI

The affected component is the router firmware's NAT/port-forwarding management logic (portFw) and its associated Application Layer Gateway (alg) function. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates user-controlled input is passed into a shell command without sanitization, so shell metacharacters injected into port-forwarding/ALG parameters are executed by the underlying embedded Linux/BusyBox system. Because consumer routers typically run their web and service daemons as root, successful injection yields full root-level control. The single CPE, cpe:2.3:a:msi:radix_axe6600, scopes impact specifically to the MSI Radix AXE6600 platform.

RemediationAI

Patch available per vendor advisory: update the MSI Radix AXE6600 to the latest firmware from the MSI support page (https://us.msi.com/Networking/RadiX-AXE6600-WiFi-6E-Tri-Band-Gaming-Router/support); an exact fixed firmware version was not specified in the provided data, so confirm the build post-upgrade and cross-check against the VulnCheck advisory (https://www.vulncheck.com/advisories/msi-radix-axe6600-v781521-command-injection-via-portfw-function). Until patched, disable remote/WAN-side administration and disable the port-forwarding and ALG features if not required, since those are the exploited entry points (trade-off: breaks inbound port-forwarding and some NAT-traversal for gaming/VoIP). Additionally restrict access to the router management interface to trusted LAN hosts and block external access to the admin service, accepting the operational cost of losing remote management.