MSI Radix AXE6600 CVE-2026-71988

Exploitation requires network reachability to the MSI Radix AXE6600's port-forwarding (portFw) management function and its ALG handler on firmware v781521; the attacker supplies malicious input to the alg function to inject OS commands. Per CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N, no authentication and no user interaction are required against the affected firmware. The primary real-world limiting factor is exposure: the vulnerable service must be reachable by the attacker (e.g., a WAN-exposed management interface, or an attacker already on the LAN/Wi-Fi), so devices whose admin/ALG interface is not internet-facing are substantially harder to reach.

The signals point to genuine high priority rather than an inflated score: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes unauthenticated, network-reachable, low-complexity exploitation with High confidentiality, integrity, and availability impact on the vulnerable system, and CWE-78 command injection reliably yields deterministic code execution. No EPSS probability, SSVC decision, POC flag, or KEV listing was provided, so exploitation is currently theoretical from a public-evidence standpoint even though technical impact is maximal; the absence of these signals is a data gap, not evidence of low risk. Because this is a consumer/prosumer gaming router that is often exposed to the internet through its management or port-forwarding interface, even a mid-sized municipal IT team in mielec that runs a handful of these devices should treat this as urgent and patch quickly. The main mitigating factor is deployment footprint rather than exploit difficulty: if the affected service is not reachable from untrusted networks, real-world exposure drops sharply.

An attacker who can reach the router's management/ALG interface sends a crafted port-forwarding request containing shell metacharacters in a parameter processed by the portFw/alg logic. The injected command runs as root, giving the attacker full device control to pivot into the internal network, capture traffic, or install persistent malware. No public exploit code is currently identified, but the low attack complexity makes weaponization straightforward.