CVE-2026-71985: MSI Radix AXE6600 Router RCE Vulnerability

CVE-2026-71985 Overview

CVE-2026-71985 is a command injection vulnerability [CWE-78] in the MSI Radix AXE6600 Wi-Fi 6E gaming router running firmware version v781521. The flaw resides in the accesscontrol function, which fails to sanitize user-supplied input before passing it to a system shell. Remote, unauthenticated attackers can inject arbitrary operating system commands and obtain root privileges on the underlying Linux system. The vulnerability received a CVSS 4.0 base score of 9.3 and is tracked by VulnCheck MSI Advisory V781521.

Critical Impact
Unauthenticated remote attackers can execute arbitrary commands with root privileges on affected MSI Radix AXE6600 routers, enabling full device takeover, traffic interception, and lateral movement into internal networks.

Affected Products

MSI Radix AXE6600 Wi-Fi 6E Tri-Band Gaming Router
Firmware version v781521
Devices exposing the accesscontrol web management function

Discovery Timeline

2026-08-09 - CVE-2026-71985 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-71985

Vulnerability Analysis

The MSI Radix AXE6600 router firmware exposes an accesscontrol function within its web management interface. This function processes attacker-controllable parameters and forwards them into a shell command without input validation or output encoding. Because the router's web service runs with root privileges, any injected command inherits full administrative control over the device.

Successful exploitation grants attackers persistent root access on the underlying embedded Linux system. From this position, adversaries can modify DNS settings, intercept and modify LAN traffic, deploy botnet payloads such as Mirai variants, and pivot into internal network segments protected by the router.

The vulnerability is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command. It requires no authentication, no user interaction, and is exploitable over the network from any host that can reach the router's management interface.

Root Cause

The root cause is missing input sanitization within the accesscontrol handler. User-supplied values are concatenated directly into shell command strings and executed via a system-call primitive such as system() or popen(). Shell metacharacters including ;, |, &, and backticks are neither filtered nor escaped, allowing arbitrary command chaining.

Attack Vector

Attackers deliver crafted HTTP requests to the router's web administration interface targeting the accesscontrol endpoint. When the management interface is exposed to the WAN, exploitation is possible directly from the internet. When restricted to the LAN, any compromised device or malicious guest on the wireless network can trigger the flaw.

The vulnerability manifests when unsanitized parameters reach the shell interpreter. Refer to the VulnCheck MSI Advisory V781521 for the technical proof-of-concept details.

Detection Methods for CVE-2026-71985

Indicators of Compromise

Unexpected outbound connections from the router's management IP to unfamiliar hosts, indicating reverse shells or malware download attempts.
HTTP POST or GET requests to the router's accesscontrol endpoint containing shell metacharacters such as ;, |, &, $(, or backticks.
Unauthorized changes to DNS server settings, firewall rules, or administrative credentials on the router.
New processes running under root that are not part of the stock MSI firmware image.

Detection Strategies

Inspect web server access logs on the router or upstream network monitoring appliances for anomalous parameters submitted to the accesscontrol function.
Deploy network intrusion detection signatures for command injection patterns targeting HTTP requests to router management interfaces on ports 80, 443, and 8080.
Baseline outbound traffic from network infrastructure devices and alert on deviations, particularly connections to non-standard ports or known malware infrastructure.

Monitoring Recommendations

Enable syslog forwarding from the MSI router to a centralized log aggregator for retention and analysis.
Monitor DNS query patterns originating from LAN clients for signs of DNS hijacking initiated at the router level.
Track configuration change events and administrative logins on the router; investigate any activity that lacks a corresponding authorized change ticket.

How to Mitigate CVE-2026-71985

Immediate Actions Required

Disable remote (WAN-side) administration on the MSI Radix AXE6600 to eliminate exposure from the public internet.
Restrict LAN-side access to the web management interface to a dedicated management VLAN or specific trusted IP addresses.
Rotate the router administrator password and any credentials that may have been stored or transmitted through the device.
Audit router configuration for unauthorized DNS, port-forwarding, and firewall changes; restore to a known-good baseline if tampering is suspected.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2026-71985. Administrators should monitor the MSI Radix AXE6600 Support page for firmware updates addressing the accesscontrol command injection flaw and apply them immediately upon release.

Workarounds

Place the router behind an upstream firewall or ISP-managed gateway that blocks inbound connections to management ports.
Segment IoT and guest devices onto isolated VLANs so a compromised endpoint cannot reach the router's administrative interface.
Where feasible, replace the affected device with a supported router until MSI releases a patched firmware version.

bash

# Example: block WAN-side access to router management ports on an upstream firewall
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 8080 -j DROP