Which versions of MSI Radix AXE6600 are affected by CVE-2026-71990?

The MSI Radix AXE6600 Wi-Fi 6E router (firmware v781521) contains a critical remote code injection vulnerability enabling root-level device compromise.. A patch is available.

How to fix or mitigate CVE-2026-71990?

Within 24 hours, scan your network inventory to identify all MSI Radix AXE6600 routers running firmware v781521 and locate the patched firmware version from MSI's security advisory. Within 7 days, systematically update all affected routers to the patched firmware version, prioritizing networks containing sensitive systems. Within 30 days, validate successful firmware updates across all devices and establish monitoring for anomalous router-level activity.

MSI Radix AXE6600 CVE-2026-71990

Q: What is the CVSS score of CVE-2026-71990?

CVE-2026-71990 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.4%.

EUVD-2026-54833 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-h97r-c273-2mq2

Command Injection Radix Axe6600 Msi

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable low-complexity command injection yielding root (C/I/A:H), but a router SSH-config interface realistically requires authenticated admin access, so PR:L rather than PR:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 09, 2026 - 00:03 vuln.today

CVE Published

Aug 08, 2026 - 23:37 cve.org

CRITICAL 9.3

DescriptionCVE.org

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for SSH configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the SSH configuration interface to inject malicious commands and obtain root privileges on the underlying system.

AnalysisAI

Command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers inject OS commands through the TelnetSSH function that handles SSH configuration, yielding root-level control of the device. The flaw is a CWE-78 OS command injection tied to unsanitized input reaching a shell context; MSI has released a firmware fix and the issue was reported by VulnCheck. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 9.3 reflects full compromise of the underlying system.

Technical ContextAI

The affected component is the router's management firmware, specifically the TelnetSSH function used to configure the SSH service on the MSI Radix AXE6600 (CPE cpe:2.3:a:msi:radix_axe6600:*:*:*:*:*:*:*:*). CWE-78 (Improper Neutralization of Special Elements used in an OS Command) means user-controllable input from the SSH configuration workflow is passed into a system shell invocation without adequate sanitization or argument separation, so shell metacharacters (e.g. ;, |, &&, backticks) are interpreted as additional commands. Because embedded router firmware typically runs its web/CLI management daemons as root, injected commands inherit root privileges, giving full control of the embedded Linux system rather than a sandboxed context.

RemediationAI

Apply the MSI firmware update: a patch is available per the vendor, so upgrade to the fixed firmware published on the MSI Radix AXE6600 support page (https://us.msi.com/Networking/RadiX-AXE6600-WiFi-6E-Tri-Band-Gaming-Router/support); an exact patched version string is not provided in the input, so confirm the release that supersedes v781521 directly on that page before deploying. Until patched, restrict access to the router management/SSH configuration interface by disabling remote (WAN-side) administration so the interface is not reachable from the internet, and limit LAN access to the admin panel to trusted management hosts or a dedicated management VLAN - the trade-off is reduced remote-management convenience. Disable the SSH service configuration feature if it is not required, and change default/admin credentials to reduce the chance an attacker reaches the vulnerable TelnetSSH workflow; note that disabling SSH removes that management capability. Cross-check details in the VulnCheck advisory at https://www.vulncheck.com/advisories/msi-radix-axe6600-v781521-command-injection-via-telnetssh-function.