Which versions of MSI Radix AXE6600 are affected by EUVD-2026-54828?

MSI Radix AXE6600 Wi-Fi 6E gaming router users face network takeover risk from a critical vulnerability requiring no authentication.. A patch is available.

How to fix or mitigate EUVD-2026-54828?

Within 24 hours: Identify all deployed MSI Radix AXE6600 units running firmware v781521 and isolate affected routers from production networks if possible, or segment network access until patching. Within 7 days: Apply the vendor-released patch by updating all identified AXE6600 routers to the latest available firmware version that addresses CVE-2026-71985. Within 30 days: Conduct a network security audit to assess whether any unauthorized access or lateral movement occurred on networks previously served by vulnerable routers, and implement enhanced monitoring for suspicious activity on restored systems.

MSI Radix AXE6600 EUVD-2026-54828

Q: What is the CVSS score of EUVD-2026-54828?

EUVD-2026-54828 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.4%.

| CVE-2026-71985 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-6gf2-4hq6-7fxh

Command Injection Radix Axe6600 Msi

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable command injection (PR:N/UI:N/AC:L) giving root code execution, so C/I/A all High; scope Unchanged as impact stays within the router OS.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 09, 2026 - 00:00 vuln.today

CVE Published

Aug 08, 2026 - 23:21 cve.org

CRITICAL 9.3

DescriptionCVE.org

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the accesscontrol function to execute malicious commands and obtain root privileges on the underlying system.

AnalysisAI

Remote command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets attackers reach the device's 'accesscontrol' function and run arbitrary OS commands, yielding full root control of the underlying Linux system. The published CVSS 4.0 vector (AV:N/PR:N/UI:N) indicates unauthenticated network-facing exploitation, and the flaw was reported by VulnCheck, which has published a dedicated advisory. No public exploit is identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

The affected device is a consumer/gaming tri-band Wi-Fi 6E router (CPE cpe:2.3:a:msi:radix_axe6600). Like most SOHO routers, its web management interface exposes CGI-style handlers backed by a busybox/Linux userland; the 'accesscontrol' function (typically an ACL/parental-control or MAC-filter handler) appears to pass attacker-supplied input into a shell command without adequate sanitization. This is a classic CWE-78 (OS Command Injection) root cause: user input is concatenated into a command string interpreted by a system shell, so shell metacharacters (;, |, `, $()) break out of the intended argument and execute attacker commands. Because router firmware daemons commonly run as root, injected commands inherit root privileges as described.

RemediationAI

Patch is available per vendor advisory; apply the fixed MSI firmware for the Radix AXE6600 from the vendor support page (https://us.msi.com/Networking/RadiX-AXE6600-WiFi-6E-Tri-Band-Gaming-Router/support) - no exact fixed version string is provided in the input, so confirm the target build against MSI's release notes before deploying. Until patched, disable remote/WAN management of the router web interface so the 'accesscontrol' handler is not reachable from the internet (trade-off: administrators lose off-LAN configuration and must manage locally); restrict access to the management interface to a trusted admin VLAN or specific host IPs (trade-off: added network segmentation overhead); and change default admin credentials plus monitor for unexpected outbound connections indicative of a compromised router. Reference the VulnCheck advisory (https://www.vulncheck.com/advisories/msi-radix-axe6600-v781521-command-injection-via-accesscontrol-function) for detection and detail.