Which versions of MSI Radix AXE6600 are affected by CVE-2026-71991?

The MSI Radix AXE6600 WiFi 6E gaming router (firmware v781521) contains a critical remote command injection vulnerability enabling attackers to achieve root-level device compromise and complete…

How to fix or mitigate CVE-2026-71991?

Within 24 hours, audit network infrastructure and user devices to identify all MSI Radix AXE6600 routers running firmware v781521, prioritizing any deployed in critical network paths. Within 7 days, implement network-level compensating controls by restricting management interface access via firewall rules to trusted networks only, disabling remote management features if not required, and enabling monitoring for unauthorized telnet and SSH connection attempts on affected devices. Within 30 days, establish vendor contact to track patch release timelines, evaluate device replacement for mission-critical deployments, and reassess network architecture to isolate gaming and consumer-grade infrastructure from business-critical systems.

MSI Radix AXE6600 CVE-2026-71991

Q: What is the CVSS score of CVE-2026-71991?

CVE-2026-71991 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.4%.

EUVD-2026-54834 CRITICAL

OS Command Injection (CWE-78)

2026-08-09 disclosure@vulncheck.com

GHSA-3mcf-6wx8-8w5c

Command Injection

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable Telnet config interface with low complexity, but the injection sits in a configuration function normally requiring admin access, so PR:L; root command execution gives C/I/A High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 09, 2026 - 00:27 vuln.today

CVE Published

Aug 09, 2026 - 00:16 cve.org

CRITICAL 9.3

DescriptionCVE.org

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for Telnet configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the Telnet configuration interface to inject malicious commands and obtain root privileges on the underlying system.

AnalysisAI

Command injection in the MSI Radix AXE6600 WiFi 6E gaming router (firmware v781521) lets attackers reach the TelnetSSH function that handles Telnet configuration and inject shell metacharacters, yielding arbitrary command execution as root. Reported to NVD via VulnCheck and tagged as Command Injection, the flaw grants full device takeover, but no public exploit or CISA KEV listing has been identified and no patched firmware version has been published. CVSS 4.0 is scored 9.3 and reflects network reach with total loss of confidentiality, integrity, and availability on the router.

Technical ContextAI

The affected component is the router's embedded management stack - specifically the TelnetSSH routine that configures the Telnet service on the MSI Radix AXE6600, a consumer Wi-Fi 6E tri-band gaming router running Linux-based firmware (v781521). The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): user-supplied input passed to the Telnet configuration handler is concatenated into a system-level shell call (system()/popen()-style execution or a shelled-out service restart) without neutralizing shell metacharacters such as ;, |, backtick, or $(). Because these SOHO router services typically run as root, injected commands execute in the highest-privilege context of the underlying embedded (BusyBox-class) Linux environment. No CPE strings were supplied in the intelligence feed, so the exact affected build is pinned only to the vendor-stated firmware string v781521.

RemediationAI

No vendor-released patch identified at time of analysis; MSI has published no fixed firmware version in the available references, so monitor the MSI support page (https://us.msi.com/Networking/RadiX-AXE6600-WiFi-6E-Tri-Band-Gaming-Router/support) for a build superseding v781521 and apply it once released. As compensating controls, disable the Telnet/Telnet-configuration service entirely if it is not required (this removes the vulnerable interface at the cost of losing Telnet management), and if it must remain enabled, restrict access to the management plane to trusted LAN hosts and block Telnet (TCP/23) and remote/WAN administration at the network edge - accepting that this does not stop an attacker already on the LAN. Change default administrative credentials and place the management interface on an isolated VLAN to limit who can reach the configuration interface. Review the VulnCheck advisory (https://www.vulncheck.com/advisories/msi-radix-axe6600-v781521-command-injection-via-telnetssh-function-used-for-telnet-configuration) for any updated fix guidance.