MSI Radix AXE6600 CVE-2026-71989

Exploitation requires network reachability to the router's port-triggering management path - specifically the porTrigger function invoked through the alg function on firmware v781521 - and no authentication or user interaction (CVSS PR:N/UI:N/AC:L). The concrete prerequisite is that the vulnerable porTrigger/alg service endpoint is exposed to the attacker; the practical limiting factor is device exposure, since consumer routers commonly present this interface only to the LAN by default unless remote/WAN administration is enabled, which would narrow real-world attackers to the local network segment. The flaw is tied to the specific vulnerable firmware build (v781521), so patched or differing firmware limits applicability.

All signals point to high real-world risk rather than an inflated CVSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA all High) indicates unauthenticated, low-complexity network exploitation with total system compromise, and CWE-78 command injection to root is directly weaponizable. No EPSS score was provided in the input, and the vulnerability is not in CISA KEV, so there is no evidence of active mass exploitation yet - treat exploitation status as 'no public exploit identified at time of analysis.' The primary uncertainty is exposure: routers are only remotely exploitable to the degree the vulnerable porTrigger/alg interface is reachable from the WAN or an untrusted LAN. The vector asserts AV:N, but for consumer routers the management/service plane is often LAN-facing by default, which may make realistic exploitation adjacent-network rather than open-internet - verify the interface's default exposure with MSI before assuming trivial internet-wide reachability.

An attacker with network access to the router's management interface sends a crafted request to the port-triggering (porTrigger) handler via the alg function, embedding shell metacharacters in a parameter that is passed to a system call. The injected command runs as root, giving the attacker full control of the device - enabling traffic interception, pivoting into the internal network, or persistent implantation. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N), though a public POC is not confirmed at time of analysis.