EUVD-2026-37553Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Web console is network-reachable (AV:N) and injection is straightforward once authenticated (AC:L), but administrator login is required (PR:H); root execution yields full C/I/A impact on the device only (S:U).
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary command execution with the root privilege by a user who logs in to the web console as an administrator.
AnalysisAI
Authenticated OS command injection in MSI RadiX AX6600 WiFi 6 Tri-Band Gaming Router lets an administrator of the web console execute arbitrary operating system commands as root. The flaw was reported through JPCERT/JVN (JVN20769211) and carries a CVSS 3.0 score of 7.2; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to first authenticate to the RadiX AX6600 web console as an administrator (PR:H), and to reach that console over the network - typically the LAN, unless the user has explicitly enabled WAN-side remote management. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H reflects network-reachable exploitation but explicitly requires high privileges (administrator login to the web console), which is the dominant risk-limiter and the reason the base score sits at 7.2 rather than near 10. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained administrator credentials (via phishing, credential reuse, default passwords, or a chained pre-auth flaw) logs into the RadiX AX6600 web console and submits a crafted value into a vulnerable management field that gets concatenated into a shell command, appending arbitrary commands with shell metacharacters. The injected payload runs as root, allowing the attacker to install persistent malware on the router, pivot into the LAN, intercept or redirect DNS/HTTP traffic, or enroll the device into a botnet. … |
| Remediation | No vendor-released patch identified at time of analysis in the provided data; check the MSI RadiX AX6600 support page at https://www.msi.com/Networking/RadiX-AX6600-WiFi-6-Tri-Band-Gaming-Router/support and JVN20769211 at https://jvn.jp/en/jp/JVN20769211/ for the fixed firmware version and apply it as soon as it ships. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct inventory of all MSI RadiX AX6600 routers in production and identify which support critical business functions; restrict web console access to named administrator accounts only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today