Critical Command Injection Hits MSI Radix

MSI Radix AXE6600 router firmware version v781521 is affected by a critical command injection vulnerability. Tracked as CVE-2026-71983, the flaw carries a CVSS 3.1 score of 9.8, indicating the highest level of severity due to its potential for unauthenticated remote exploitation.

What's at Risk

The vulnerability exists within the wps.cgi interface of the MSI Radix AXE6600. Because this interface is typically accessible over the network, any device running the affected firmware version is at risk of remote compromise. Organizations or home users utilizing this specific router model as their primary gateway to the internet are particularly exposed to external threats.

When a device is compromised through this interface, an attacker can gain root privileges. This level of access grants the intruder full control over the router, allowing them to intercept traffic, modify network configurations, or use the device as a pivot point to attack other systems connected to the local network.

How the Flaw Works

Command injection is a vulnerability that occurs when an application fails to properly sanitize user-supplied input before passing it to a system shell. In this specific case, the pin2g, pin5g, and pin6g parameters are susceptible to malicious input. When an attacker provides crafted data into these fields, the underlying system may inadvertently execute that data as a command.

Generally, this class of vulnerability allows an attacker to bypass standard authentication mechanisms. By injecting shell metacharacters, a remote actor can force the device to execute arbitrary instructions with the privileges of the web service. This often leads to a complete loss of confidentiality, integrity, and availability for the affected hardware, as the attacker effectively becomes the system administrator.

How to Protect Your Systems

• Check the official MSI support website for the latest firmware updates and apply them immediately to mitigate the risk.
• Restrict access to the router's web management interface to trusted internal IP addresses only.
• Disable WPS (Wi-Fi Protected Setup) functionality if it is not strictly required for your network configuration.
• Monitor router logs for unusual traffic patterns or unauthorized configuration changes.
• Ensure that your network devices are not exposed directly to the public internet unless absolutely necessary.

Given the CRITICAL severity rating of CVE-2026-71983, immediate action is required to secure affected infrastructure. Command injection flaws are frequently targeted because they provide a direct path to total system takeover. Applying available patches and limiting the attack surface of your hardware are the most effective ways to defend against this vulnerability.