RadiX AX6600 EUVD-2026-37553

Exploitation requires an authenticated session on the router's web management console with administrator privileges (CVSS PR:H); the flaw is reached through a web-console function that passes attacker-supplied input to an OS shell (CWE-78). The primary limiting factor is the administrator-authentication requirement - this is not a pre-auth or unauthenticated bug, so real-world risk hinges on how the admin interface is protected (default/weak/reused credentials, management interface exposed to untrusted networks, or chaining from a separate auth-bypass). No user interaction beyond the attacker's own admin actions is needed (UI:N), and attack complexity is low (AC:L). Affected: firmware versions prior to v781521; updating to v781521 is the remediation per the vendor/JVN disclosure.

This is a genuinely high-impact but access-gated flaw whose signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H) and the SSVC framework agree: Technical Impact is 'total' (OS command execution as root), but exploitation requires PR:H - the attacker must already be authenticated to the web console as an administrator. SSVC reports Exploitation: none and Automatable: no, and EPSS is modest at 1.79% (75th percentile), so there is no evidence of widespread or automated exploitation. The vuln.today priority of 'this_week' and JPCERT/JVN coordinated disclosure indicate a credible, vendor-acknowledged issue worth prompt patching, not an emergency. The key caveat: the high CVSS base score is driven by total impact, while the real-world gating factor is the administrator-credential prerequisite - an attacker who already holds admin web access converts that bounded control into full root OS control (privilege escalation / persistence beyond the intended management surface). This matters most where admin credentials are default, shared, weak, or reachable (e.g., exposed management interface, reused passwords, or chaining from another web-auth bypass). Treat as a 'patch this week' item, not a drop-everything network-exposed RCE.

An attacker who has obtained administrator access to the router's web console (via default/weak/reused credentials or a separate auth flaw) submits crafted input to a web-console function that passes it to an OS shell, injecting commands that run with root privilege. No public exploit has been identified at time of analysis, and SSVC lists exploitation as none. Low attack complexity (AC:L) means that once admin access is held, triggering the injection is straightforward.