MSI Radix AXE6600 CVE-2026-71990

Exploitation requires reaching the SSH configuration interface (the TelnetSSH function) of an MSI Radix AXE6600 running firmware v781521 and submitting configuration input containing shell metacharacters. The vendor vector rates it PR:N (no privileges), but because this is a router management/configuration interface, realistic exploitation is most likely limited to attackers who have access to the admin management plane - i.e., valid admin credentials and/or network reachability to the management interface - so WAN-side remote administration being enabled, or attacker presence on the LAN, is the practical prerequisite and the main limiting factor. Exploitation is constrained to the specific affected firmware version (v781521) on this specific product; no user interaction is required per the vector.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) describes trivial remote unauthenticated exploitation with total impact, which would make this a high priority; however, the description states exploitation occurs 'through the SSH configuration interface,' and on consumer routers that interface is normally reached only after authenticating to the admin panel - so the PR:N rating is questionable and should be verified with the vendor, since real risk differs sharply between a truly unauthenticated bug and an authenticated-admin bug. EPSS is not provided, the CVE is not in CISA KEV, and no POC is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation, tempering urgency relative to the raw score. That said, root-level command injection on an internet-facing or LAN-facing gaming router is serious once an attacker reaches the management interface - any operator running these devices, even a mid-sized municipal IT team, should apply the firmware update promptly and restrict management-plane exposure. The key conflict to resolve is authentication: if PR:N holds and the interface is exposed to the WAN, this is a genuine critical; if it requires admin credentials or LAN access, it is a high-severity but more constrained issue.

An attacker who can reach the router's SSH configuration interface submits a crafted SSH configuration value containing shell metacharacters, causing the TelnetSSH function to execute attacker-supplied commands as root. With AV:N/AC:L the request is low-complexity over the network, and successful injection lets the attacker install persistent implants, capture traffic, or pivot into the internal network. No public exploit is identified at time of analysis, so this reflects the described mechanics rather than a released POC.