MSI Radix AXE6600 CVE-2026-71993

Exploitation requires reaching the router's web management interface and submitting malicious input to the OpenVPN or MAC-filter configuration function (the two functions named in the description), which passes unsanitized input to an OS command. The vendor vector marks this PR:N/UI:N (no authentication or user interaction), but because these are administrative configuration handlers, realistic exploitation likely requires access to the authenticated admin panel or LAN-side reachability rather than arbitrary internet access - this authentication tension is not resolvable from the available data and should be confirmed against the firmware. Limiting factors: the management UI is typically LAN-only unless remote administration is explicitly enabled, and only firmware v781521 of the specific Radix AXE6600 model is named as affected.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) rates this 9.3 and implies remote, unauthenticated, low-complexity exploitation yielding full compromise. However, the description names the openvpn and macfilter functions - these are router administrative configuration features that on most deployments sit behind the authenticated management UI, so the PR:N (no privileges) rating is optimistic and should be verified against the actual firmware; realistic exploitation may require authenticated or LAN-side access to the admin panel. No EPSS score, KEV listing, or POC was provided: this is not confirmed as actively exploited, and no public exploit was identified at time of analysis, so the raw 9.3 reflects worst-case impact rather than demonstrated in-the-wild activity. The description is also internally inconsistent - it attributes the injection to the openvpn function in one sentence and the macfilter function in the next - which should be confirmed with the VulnCheck advisory. Overall: high potential impact (root on a network gateway) but the priority hinges on whether the vector is truly pre-authentication and internet-facing versus LAN/authenticated only.

An attacker who can reach the router's management interface submits a crafted value to the openvpn or macfilter configuration handler containing shell metacharacters, which the firmware passes to a system shell running as root. The injected command executes with root privileges, giving the attacker full control of the gateway to intercept traffic, pivot into the LAN, or install persistence. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means a working request would be trivial to reproduce once the vulnerable parameter is known.