MSI Radix AXE6600 EUVD-2026-54827

Exploitation requires network reachability to the AXE6600's urlfilter function (the URL-filtering feature of the router's management interface) and the target running firmware v781521; per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication, no user interaction, and no special attack requirements are needed against an affected device. The primary limiting factor is exposure of that interface: an attacker must be able to reach the urlfilter endpoint, so devices whose management/urlfilter interface is confined to a trusted LAN are far less exposed than those with WAN-side remote management or guest-network access enabled. No non-default configuration is stated as a prerequisite in the description, meaning affected-version devices are exploitable in their normal operating state once the endpoint is reachable.

The signals align toward high real-world risk: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes network-reachable, low-complexity, unauthenticated exploitation with total confidentiality, integrity, and availability impact, and a base score of 9.3. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed active exploitation - but the combination of unauthenticated root and a trivially reachable feature means even a mid-sized municipal IT team in ustka should treat this as urgent for any exposed or guest-accessible AXE6600. EPSS and SSVC automatability data were not supplied in the input, so probabilistic exploitation likelihood cannot be quantified here; the practical caveat is that routers with the management/urlfilter interface exposed to the WAN or untrusted LAN segments are meaningfully more at risk than those reachable only from a trusted internal network. The reporting by VulnCheck adds credibility to the technical findings even absent published POC code.

An attacker who can reach the router's management interface sends a crafted request to the urlfilter function containing shell metacharacters and an injected command; because the input is passed to a root-context shell, the command executes with full privileges. From there the attacker installs persistent malware, pivots into the internal network, or enrolls the device into a botnet. No authentication is required per the CVSS vector, and low attack complexity means the request can be automated once the endpoint is reachable.