Which versions of MSI Radix AXE6600 are affected by CVE-2026-71992?

The MSI Radix AXE6600 Wi-Fi 6E router contains a critical remote command injection vulnerability enabling unauthenticated attackers to seize complete control of the network edge device without user…. A patch is available.

How to fix or mitigate CVE-2026-71992?

Within 24 hours, identify and inventory all MSI Radix AXE6600 Wi-Fi 6E units running firmware v781521 across your organization. Within 7 days, obtain and apply the vendor-released patch to all affected devices, prioritizing network-critical segments and internet-facing deployments. Within 30 days, verify patch deployment completion through device management systems, isolate or decommission any devices that cannot be patched, and update network access policies to segment vulnerable devices until remediation is complete.

MSI Radix AXE6600 CVE-2026-71992

Q: What is the CVSS score of CVE-2026-71992?

CVE-2026-71992 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.4%.

EUVD-2026-54835 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-qj2h-vw2g-6rh7

Command Injection Radix Axe6600 Msi

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable command injection (PR:N/UI:N/AC:L) yielding root code execution gives full C/I/A impact; scope unchanged as the OS is the vulnerable component.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 09, 2026 - 00:27 vuln.today

CVE Published

Aug 08, 2026 - 23:52 cve.org

CRITICAL 9.3

DescriptionCVE.org

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the macfilter function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject malicious commands and obtain root privileges on the underlying system.

AnalysisAI

OS command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers inject shell commands through the router's macfilter function and gain root on the device. The flaw was reported by VulnCheck and carries a CVSS 4.0 base score of 9.3, reflecting network-reachable, no-privilege, no-interaction exploitation with full compromise of confidentiality, integrity, and availability. No public exploit is identified at time of analysis, though the low-complexity, unauthenticated nature makes weaponization straightforward.

Technical ContextAI

The vulnerability is a classic CWE-78 OS command injection in an embedded consumer/SOHO router. The macfilter feature is the MAC-address access-control list of the router's web/management interface; user-supplied MAC values (or associated parameters) are passed into an underlying shell command without adequate sanitization, so metacharacters such as ';', '|', '`', or '$()' break out of the intended command and are executed by the device's Linux shell. Because router firmware management daemons typically run as root, injected commands execute with root privileges. The CPE cpe:2.3:a:msi:radix_axe6600:*:*:*:*:*:*:*:* identifies the affected product, with firmware v781521 named in the description.

RemediationAI

Patch available per vendor advisory: apply the fixed firmware from the MSI Radix AXE6600 support page at https://us.msi.com/Networking/RadiX-AXE6600-WiFi-6E-Tri-Band-Gaming-Router/support (an exact patched firmware version was not provided in the input and should be confirmed on that page); the VulnCheck advisory at https://www.vulncheck.com/advisories/msi-radix-axe6600-v781521-command-injection-via-macfilter provides technical detail. Until firmware is updated, restrict access to the router's administrative interface: disable any remote/WAN management so the web UI is not reachable from the internet (trade-off: loss of off-LAN administration), and place the management interface behind a firewall/ACL that limits it to a trusted management host or VLAN (trade-off: added operational overhead). Avoid using the MAC filter feature and change default administrative credentials to reduce the chance a remote attacker reaches the vulnerable macfilter endpoint, and monitor the device for unexpected outbound connections that could indicate botnet enrollment.