CVE-2026-71983: MSI Radix AXE6600 Router RCE Vulnerability

CVE-2026-71983 Overview

CVE-2026-71983 is a command injection vulnerability in the MSI Radix AXE6600 router running firmware version v781521. The flaw resides in the wps.cgi interface, which fails to sanitize the pin2g, pin5g, and pin6g parameters before passing them to a shell context. Remote unauthenticated attackers can inject arbitrary operating system commands through these parameters and gain root privileges on the device. The weakness is tracked under CWE-78: OS Command Injection.

Critical Impact
Unauthenticated remote attackers can execute arbitrary commands as root on affected MSI Radix AXE6600 routers, resulting in full device compromise.

Affected Products

MSI Radix AXE6600 WiFi 6E Tri-Band Gaming Router
Firmware version v781521
wps.cgi interface component

Discovery Timeline

2026-08-08 - CVE-2026-71983 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-71983

Vulnerability Analysis

The vulnerability exists in the wps.cgi handler on the MSI Radix AXE6600 router. The CGI endpoint processes Wi-Fi Protected Setup (WPS) PIN values submitted through the pin2g, pin5g, and pin6g HTTP parameters. These parameter values are concatenated into a shell command string without input validation, escaping, or use of safe process invocation APIs.

Because the router web service runs with root privileges and the wps.cgi endpoint is reachable over the network, an attacker can achieve full command execution on the underlying Linux system. Successful exploitation grants persistent control of the router, allowing traffic interception, DNS manipulation, lateral movement into the LAN, and use of the device as a foothold for further attacks.

Root Cause

The root cause is missing input sanitization on WPS PIN parameters inside wps.cgi. Shell metacharacters such as backticks, semicolons, pipes, and $() substitutions embedded in pin2g, pin5g, or pin6g are interpreted by the invoked shell rather than treated as literal PIN data. This maps directly to CWE-78, Improper Neutralization of Special Elements used in an OS Command.

Attack Vector

Exploitation requires only network access to the router's web management interface. No authentication and no user interaction are needed. An attacker submits a crafted HTTP request to wps.cgi containing shell metacharacters in one of the vulnerable PIN parameters. The injected commands execute as root, giving the attacker complete control of the device. See the VulnCheck Advisory MSI Radix AXE6600 for additional technical detail.

Detection Methods for CVE-2026-71983

Indicators of Compromise

HTTP requests to wps.cgi containing shell metacharacters (;, |, &, backticks, or $()) inside the pin2g, pin5g, or pin6g parameters.
Unexpected outbound connections initiated by the router to attacker-controlled infrastructure.
New or modified processes on the router, unusual iptables rules, or unauthorized changes to DNS settings.
Router web administration access from unfamiliar external IP addresses.

Detection Strategies

Inspect web server and CGI logs on the router for requests to wps.cgi with abnormally long or non-numeric PIN parameter values.
Monitor network traffic for HTTP POST or GET requests to the router's management interface originating from the WAN side.
Alert on DNS or DHCP configuration changes on the router that are not associated with an administrator action.

Monitoring Recommendations

Forward router syslog and CGI access logs to a centralized SIEM for correlation and retention.
Track outbound connections from the router IP to detect command-and-control activity following exploitation.
Baseline normal WPS activity and alert on deviations, since WPS PIN authentication requests should be infrequent.

How to Mitigate CVE-2026-71983

Immediate Actions Required

Disable remote (WAN-side) administration on the MSI Radix AXE6600 immediately.
Disable the WPS feature on the router until a firmware fix is available.
Restrict access to the LAN-side management interface to trusted administrator hosts only.
Rotate router administrator credentials and Wi-Fi pre-shared keys if compromise is suspected.

Patch Information

At the time of publication, no vendor-supplied patched firmware version is listed in the NVD entry. Administrators should monitor the MSI RadiX AXE6600 Support page for firmware updates that supersede v781521 and apply them promptly upon release.

Workarounds

Disable WPS entirely in the router configuration to remove the vulnerable code path from normal operation.
Block external access to the router's HTTP and HTTPS management ports at the ISP or upstream firewall.
Segment the router management interface onto a dedicated administrative VLAN and enforce ACLs at the switch.
Replace the affected device with a supported alternative if remote administration is a business requirement and no patch is available.

bash

# Configuration example - restrict management access at an upstream firewall
# Only allow router admin UI from a trusted management subnet
iptables -A FORWARD -p tcp -d <router_ip> --dport 80  -s 10.10.10.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -s 10.10.10.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80  -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP