Critical Command Injection Hits MSI RadiX Router

MSI RadiX AXE6600 routers running firmware version v781521 are affected by a critical command injection vulnerability. This flaw, identified as CVE-2026-71985, carries a CVSS score of 9.8 and allows remote, unauthenticated attackers to execute arbitrary commands on the underlying system.

What's at Risk

The vulnerability exists within the accesscontrol function of the device firmware. Because this function is reachable by remote attackers, any deployment of the MSI RadiX AXE6600 using version v781521 is exposed to potential compromise. This risk is particularly high for devices that have their management interfaces or specific network functions exposed directly to the internet.

When an attacker successfully exploits this type of vulnerability, they can achieve root-level privileges on the router. This level of access grants the attacker complete control over the device, allowing them to manipulate network traffic, intercept sensitive data, or use the router as a pivot point to attack other systems within the internal network.

How the Flaw Works

Command injection occurs when an application fails to properly sanitize user-supplied input before passing it to a system shell or command-line interface. In general, this class of vulnerability allows an attacker to append their own malicious commands to legitimate system functions. By manipulating the input processed by the vulnerable accesscontrol function, an attacker can force the device to execute unintended instructions with the same permissions as the application itself.

Because these flaws often bypass standard authentication mechanisms, they are highly effective for remote exploitation. Once the malicious command is executed, the attacker can leverage the system's own utilities to maintain persistence, escalate privileges, or deploy further payloads, effectively turning a networking device into a compromised node within the attacker's infrastructure.

How to Protect Your Systems

• Check the MSI support website immediately for a firmware update that addresses the CVE-2026-71985 vulnerability.
• Apply the latest vendor-supplied patches as soon as they become available to remediate the command injection flaw.
• Restrict access to the router's administrative interface, ensuring it is not exposed to the public internet.
• Implement network segmentation to ensure that if the router is compromised, the impact on the rest of your internal network is minimized.
• Monitor system logs for unusual activity or unexpected commands originating from the accesscontrol module.

Given the critical severity of this vulnerability and the potential for total system compromise, immediate action is required. Attackers frequently target routers due to their position at the edge of the network, making prompt patching essential to maintaining the security and integrity of your connected environment.