MSI Radix AXE6600 Command Injection Flaws

OS command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers inject shell commands through router configuration functions and gain root on the device. The flaw was reported by VulnCheck, a vendor patch is available via MSI support, and no public exploit has been identified at time of analysis. The vendor CVSS 4.0 score of 9.3 reflects full compromise of confidentiality, integrity, and availability.

Command injection in the MSI Radix AXE6600 WiFi 6E gaming router (firmware v781521) lets attackers reach the TelnetSSH function that handles Telnet configuration and inject shell metacharacters, yielding arbitrary command execution as root. Reported to NVD via VulnCheck and tagged as Command Injection, the flaw grants full device takeover, but no public exploit or CISA KEV listing has been identified and no patched firmware version has been published. CVSS 4.0 is scored 9.3 and reflects network reach with total loss of confidentiality, integrity, and availability on the router.