Which versions of MSI Radix AXE6600 are affected by EUVD-2026-54826?

MSI Radix AXE6600 Wi-Fi 6E routers contain a critical vulnerability enabling remote attackers to gain complete administrative control of affected devices.

How to fix or mitigate EUVD-2026-54826?

Within 24 hours, identify and catalog all MSI Radix AXE6600 routers on your network, prioritizing systems running firmware v781521 or earlier. Within 7 days, implement interim protections: disable WPS functionality where supported, isolate affected devices from sensitive network segments using network controls, and enable monitoring for exploitation attempts. Within 30 days, contact MSI support for patch availability and establish a timeline for upgrading or replacing vulnerable routers pending vendor remediation.

MSI Radix AXE6600 EUVD-2026-54826

Q: What is the CVSS score of EUVD-2026-54826?

EUVD-2026-54826 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.6%.

| CVE-2026-71983 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 disclosure@vulncheck.com

GHSA-wj6p-gv6v-932v

Command Injection

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated, low-complexity network request to wps.cgi yields root command execution, giving full C/I/A impact; scope unchanged as the command runs on the same device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 23:35 vuln.today

CVE Published

Aug 08, 2026 - 23:16 cve.org

CRITICAL 9.3

DescriptionCVE.org

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the wps.cgi interface that allows remote attackers to execute arbitrary commands by injecting malicious input through the pin2g, pin5g, or pin6g parameters. Attackers can exploit these unsanitized parameters to execute arbitrary commands on the affected device and obtain root privileges.

AnalysisAI

Command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers run arbitrary OS commands as root through the wps.cgi endpoint. The pin2g, pin5g, and pin6g WPS PIN parameters are passed to a shell without sanitization (CWE-78), giving full device takeover. Rated CVSS 4.0 9.3 (Critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is wps.cgi, a CGI handler in the router's embedded web management stack that processes Wi-Fi Protected Setup (WPS) PIN values for the 2.4 GHz (pin2g), 5 GHz (pin5g), and 6 GHz (pin6g) radios of this tri-band device. The root cause is CWE-78 (OS Command Injection): the CGI takes attacker-controlled PIN parameters and incorporates them into a system/shell command without input validation or escaping, so shell metacharacters (e.g. ;, |, `, $()) break out of the intended command context. Because embedded router web/CGI processes typically run as root on Linux-based firmware, injected commands inherit root privileges, consistent with the advisory's statement that exploitation yields root.

RemediationAI

No vendor-released patch identified at time of analysis; no fixed firmware version is cited in the available references, so monitor the MSI Radix AXE6600 support page (https://us.msi.com/Networking/RadiX-AXE6600-WiFi-6E-Tri-Band-Gaming-Router/support) and the VulnCheck advisory (https://www.vulncheck.com/advisories/msi-radix-axe6600-v781521-command-injection-via-wps-cgi) for a firmware update and apply it once released. In the interim, disable remote/WAN administration so the management interface and wps.cgi are not reachable from the internet (trade-off: no off-network admin), disable WPS on all bands since the injectable parameters are WPS PIN fields (trade-off: lose WPS push-button/PIN onboarding convenience), and restrict access to the router's web/management interface to a trusted management VLAN or specific admin hosts (trade-off: added network segmentation effort). Where feasible, place untrusted clients on an isolated guest network to reduce who can reach the LAN-side CGI.