Msi
Monthly
Integer overflow in MSI Dragon Center's NTIOLib_X64.sys kernel-mode driver (versions up to 2.0.155.0) allows local low-privileged users to corrupt kernel memory via crafted count or elementSize arguments passed to the MmioWritePath MMIO Write Path Handler. Exploitation can yield full SYSTEM-level privilege escalation on the target host. A public proof-of-concept is available, the vendor did not respond to coordinated disclosure, and no official patch has been released.
OS command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers inject shell commands through router configuration functions and gain root on the device. The flaw was reported by VulnCheck, a vendor patch is available via MSI support, and no public exploit has been identified at time of analysis. The vendor CVSS 4.0 score of 9.3 reflects full compromise of confidentiality, integrity, and availability.
OS command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers inject shell commands through the router's macfilter function and gain root on the device. The flaw was reported by VulnCheck and carries a CVSS 4.0 base score of 9.3, reflecting network-reachable, no-privilege, no-interaction exploitation with full compromise of confidentiality, integrity, and availability. No public exploit is identified at time of analysis, though the low-complexity, unauthenticated nature makes weaponization straightforward.
Command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers inject OS commands through the TelnetSSH function that handles SSH configuration, yielding root-level control of the device. The flaw is a CWE-78 OS command injection tied to unsanitized input reaching a shell context; MSI has released a firmware fix and the issue was reported by VulnCheck. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 9.3 reflects full compromise of the underlying system.
Remote code execution in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets unauthenticated network attackers inject arbitrary OS commands via the porTrigger function, reachable through the alg function, and obtain root on the device. The CVSS 4.0 base score is 9.3 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact), reflecting trivial network exploitation. The flaw was reported by VulnCheck; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Remote command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers run arbitrary OS commands as root by abusing the portFw port-forwarding function, reachable through the alg handler. The flaw was reported by VulnCheck and carries a critical CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV. A vendor patch is available per the MSI support advisory.
OS command injection in the MSI Radix AXE6600 WiFi 6E gaming router (firmware v781521) allows remote attackers to inject and execute arbitrary shell commands via the router's 'alg' (application-layer gateway) function, yielding full root privileges on the device. The CVSS 4.0 base score is 9.3 (Critical) with a fully remote, unauthenticated, low-complexity vector, and a vendor patch is available; however, no public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in the MSI Radix AXE6600 tri-band Wi-Fi 6E gaming router (firmware v781521) lets attackers reach the device's dmz configuration function, inject shell metacharacters, and execute arbitrary commands as root on the underlying Linux system. The flaw was reported by VulnCheck and carries a vendor CVSS 4.0 base score of 9.3 (VC:H/VI:H/VA:H), reflecting complete compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but a vendor firmware update is available.
Remote command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets attackers reach the device's 'accesscontrol' function and run arbitrary OS commands, yielding full root control of the underlying Linux system. The published CVSS 4.0 vector (AV:N/PR:N/UI:N) indicates unauthenticated network-facing exploitation, and the flaw was reported by VulnCheck, which has published a dedicated advisory. No public exploit is identified at time of analysis, and the CVE is not listed in CISA KEV.
Remote command injection in the MSI Radix AXE6600 WiFi 6E gaming router (firmware v781521) lets network-reachable attackers inject arbitrary OS commands through the router's urlfilter function and gain root on the device. The flaw (CWE-78) is unauthenticated per the CVSS 4.0 vector and was reported by VulnCheck; no public exploit identified at time of analysis, though full device takeover is the demonstrated impact. A vendor patch is available per the MSI support advisory.
Local privilege escalation in MSI Center's bundled NTIOLib_X64.sys kernel driver lets a low-privileged user execute arbitrary code as SYSTEM by issuing commands the driver fails to properly authenticate. The flaw (ZDI-CAN-28935 / ZDI-26-430) stems from the driver not validating the origin of incoming commands, so any local process can drive its privileged I/O primitives. There is no public exploit identified at time of analysis and it is not on CISA KEV, but ZDI's disclosure and the NTIOLib family's history of abuse make weaponization plausible.
MSI Afterburner v4.6.5.16370 is vulnerable to a Kernel Memory Leak vulnerability by triggering the 0x80002040 IOCTL code of the RTCore64.sys driver. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
MSI Afterburner v4.6.5.16370 is vulnerable to a Denial of Service vulnerability by triggering the 0x80002000 IOCTL code of the RTCore64.sys driver. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
EXEMSI MSI Wrapper Versions prior to 10.0.50 and at least since version 6.0.91 will introduce a local privilege escalation vulnerability in installers it creates. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An issue in the component MSI.TerminalServer.exe of MSI Center v1.0.41.0 allows attackers to escalate privileges via a crafted TCP packet. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Micro-Star International Co., Ltd MSI Center 1.0.50.0 was discovered to contain a vulnerability in the component C_Features of MSI.CentralServer.exe. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to download arbitrary files regardless of file type or size. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to write arbitrary files to the directory \PromoPhoto\, regardless of file type or size. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue in the Feature Navigator of Micro-Star International MSI Feature Nagivator v1.0.1808.0901 allows attackers to cause a Denial of Service (DoS) via a crafted image or video file. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MODAPI.sys in MSI Dragon Center 2.0.104.0 allows low-privileged users to access kernel memory and potentially escalate privileges via a crafted IOCTL 0x9c406104 call. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
The MsIo64.sys driver before 1.1.19.1016 in MSI Dragon Center before 2.0.98.0 has a buffer overflow that allows privilege escalation via a crafted 0x80102040, 0x80102044, 0x80102050, or 0x80102054. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
The MSI AmbientLink MsIo64 driver 1.0.0.8 has a Buffer Overflow (0x80102040, 0x80102044, 0x80102050,and 0x80102054). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Weak permissions on the "%PROGRAMDATA%\MSI\Dragon Center" folder in Dragon Center before 2.6.2003.2401, shipped with Micro-Star MSI Gaming laptops, allows local authenticated users to overwrite. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Integer overflow in MSI Dragon Center's NTIOLib_X64.sys kernel-mode driver (versions up to 2.0.155.0) allows local low-privileged users to corrupt kernel memory via crafted count or elementSize arguments passed to the MmioWritePath MMIO Write Path Handler. Exploitation can yield full SYSTEM-level privilege escalation on the target host. A public proof-of-concept is available, the vendor did not respond to coordinated disclosure, and no official patch has been released.
OS command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers inject shell commands through router configuration functions and gain root on the device. The flaw was reported by VulnCheck, a vendor patch is available via MSI support, and no public exploit has been identified at time of analysis. The vendor CVSS 4.0 score of 9.3 reflects full compromise of confidentiality, integrity, and availability.
OS command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers inject shell commands through the router's macfilter function and gain root on the device. The flaw was reported by VulnCheck and carries a CVSS 4.0 base score of 9.3, reflecting network-reachable, no-privilege, no-interaction exploitation with full compromise of confidentiality, integrity, and availability. No public exploit is identified at time of analysis, though the low-complexity, unauthenticated nature makes weaponization straightforward.
Command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers inject OS commands through the TelnetSSH function that handles SSH configuration, yielding root-level control of the device. The flaw is a CWE-78 OS command injection tied to unsanitized input reaching a shell context; MSI has released a firmware fix and the issue was reported by VulnCheck. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 9.3 reflects full compromise of the underlying system.
Remote code execution in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets unauthenticated network attackers inject arbitrary OS commands via the porTrigger function, reachable through the alg function, and obtain root on the device. The CVSS 4.0 base score is 9.3 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact), reflecting trivial network exploitation. The flaw was reported by VulnCheck; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Remote command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers run arbitrary OS commands as root by abusing the portFw port-forwarding function, reachable through the alg handler. The flaw was reported by VulnCheck and carries a critical CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV. A vendor patch is available per the MSI support advisory.
OS command injection in the MSI Radix AXE6600 WiFi 6E gaming router (firmware v781521) allows remote attackers to inject and execute arbitrary shell commands via the router's 'alg' (application-layer gateway) function, yielding full root privileges on the device. The CVSS 4.0 base score is 9.3 (Critical) with a fully remote, unauthenticated, low-complexity vector, and a vendor patch is available; however, no public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in the MSI Radix AXE6600 tri-band Wi-Fi 6E gaming router (firmware v781521) lets attackers reach the device's dmz configuration function, inject shell metacharacters, and execute arbitrary commands as root on the underlying Linux system. The flaw was reported by VulnCheck and carries a vendor CVSS 4.0 base score of 9.3 (VC:H/VI:H/VA:H), reflecting complete compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but a vendor firmware update is available.
Remote command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets attackers reach the device's 'accesscontrol' function and run arbitrary OS commands, yielding full root control of the underlying Linux system. The published CVSS 4.0 vector (AV:N/PR:N/UI:N) indicates unauthenticated network-facing exploitation, and the flaw was reported by VulnCheck, which has published a dedicated advisory. No public exploit is identified at time of analysis, and the CVE is not listed in CISA KEV.
Remote command injection in the MSI Radix AXE6600 WiFi 6E gaming router (firmware v781521) lets network-reachable attackers inject arbitrary OS commands through the router's urlfilter function and gain root on the device. The flaw (CWE-78) is unauthenticated per the CVSS 4.0 vector and was reported by VulnCheck; no public exploit identified at time of analysis, though full device takeover is the demonstrated impact. A vendor patch is available per the MSI support advisory.
Local privilege escalation in MSI Center's bundled NTIOLib_X64.sys kernel driver lets a low-privileged user execute arbitrary code as SYSTEM by issuing commands the driver fails to properly authenticate. The flaw (ZDI-CAN-28935 / ZDI-26-430) stems from the driver not validating the origin of incoming commands, so any local process can drive its privileged I/O primitives. There is no public exploit identified at time of analysis and it is not on CISA KEV, but ZDI's disclosure and the NTIOLib family's history of abuse make weaponization plausible.
MSI Afterburner v4.6.5.16370 is vulnerable to a Kernel Memory Leak vulnerability by triggering the 0x80002040 IOCTL code of the RTCore64.sys driver. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
MSI Afterburner v4.6.5.16370 is vulnerable to a Denial of Service vulnerability by triggering the 0x80002000 IOCTL code of the RTCore64.sys driver. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
EXEMSI MSI Wrapper Versions prior to 10.0.50 and at least since version 6.0.91 will introduce a local privilege escalation vulnerability in installers it creates. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An issue in the component MSI.TerminalServer.exe of MSI Center v1.0.41.0 allows attackers to escalate privileges via a crafted TCP packet. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Micro-Star International Co., Ltd MSI Center 1.0.50.0 was discovered to contain a vulnerability in the component C_Features of MSI.CentralServer.exe. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to download arbitrary files regardless of file type or size. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to write arbitrary files to the directory \PromoPhoto\, regardless of file type or size. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue in the Feature Navigator of Micro-Star International MSI Feature Nagivator v1.0.1808.0901 allows attackers to cause a Denial of Service (DoS) via a crafted image or video file. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MODAPI.sys in MSI Dragon Center 2.0.104.0 allows low-privileged users to access kernel memory and potentially escalate privileges via a crafted IOCTL 0x9c406104 call. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
The MsIo64.sys driver before 1.1.19.1016 in MSI Dragon Center before 2.0.98.0 has a buffer overflow that allows privilege escalation via a crafted 0x80102040, 0x80102044, 0x80102050, or 0x80102054. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
The MSI AmbientLink MsIo64 driver 1.0.0.8 has a Buffer Overflow (0x80102040, 0x80102044, 0x80102050,and 0x80102054). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Weak permissions on the "%PROGRAMDATA%\MSI\Dragon Center" folder in Dragon Center before 2.6.2003.2401, shipped with Micro-Star MSI Gaming laptops, allows local authenticated users to overwrite. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.