CVE-2026-71986: MSI Radix AXE6600 Router RCE Vulnerability

CVE-2026-71986 Overview

CVE-2026-71986 is a command injection vulnerability [CWE-78] affecting MSI Radix AXE6600 router firmware version v781521. The flaw resides in the dmz function of the router's web management interface. Remote attackers can inject operating system commands through the dmz function and execute arbitrary code on the underlying Linux system. Successful exploitation grants root privileges on the affected device.

The vulnerability requires no authentication, no user interaction, and is exploitable over the network. Compromised routers can be leveraged to intercept traffic, pivot into internal networks, or enroll into botnets.

Critical Impact
Unauthenticated remote attackers can execute arbitrary commands as root on MSI Radix AXE6600 routers running firmware v781521, resulting in full device compromise.

Affected Products

MSI Radix AXE6600 WiFi 6E Tri-Band Gaming Router
Firmware version v781521
Devices exposing the router web management interface

Discovery Timeline

2026-08-09 - CVE-2026-71986 published to NVD
2026-08-09 - Last updated in NVD database

Technical Details for CVE-2026-71986

Vulnerability Analysis

The vulnerability is classified as OS Command Injection under [CWE-78]. The dmz function in the MSI Radix AXE6600 firmware processes user-supplied input and passes it to a system shell without adequate sanitization or validation. An attacker who reaches the router's management interface can append shell metacharacters to a parameter consumed by the dmz function.

Because the router web services run with root privileges on the embedded Linux operating system, injected commands inherit those privileges. This gives an attacker full control over the device, including the ability to modify firmware, alter routing rules, capture traffic, and install persistent implants. The EPSS score is 1.35% at the 69.04 percentile as of 2026-08-14, indicating moderate near-term exploitation likelihood.

Root Cause

The root cause is missing input neutralization in the dmz feature handler. User input intended to specify a demilitarized zone (DMZ) host is concatenated into a shell command string. Shell metacharacters such as ;, |, `, and $() are not filtered or escaped before the command is executed by the underlying operating system.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to the router's web management endpoint that invokes the dmz function. By injecting shell metacharacters into the DMZ host parameter, the attacker forces the router to execute arbitrary commands. Devices with the management interface exposed to the internet are directly reachable. On internal networks, an attacker with LAN access can exploit the flaw without credentials.

No verified proof-of-concept code has been published. Technical details are described in the VulnCheck Advisory for MSI Radix.

Detection Methods for CVE-2026-71986

Indicators of Compromise

Unexpected outbound connections from the router to unknown IP addresses or command-and-control infrastructure
HTTP POST or GET requests to router administrative endpoints containing shell metacharacters such as ;, |, `, or $() in DMZ-related parameters
New or altered firewall, NAT, or DMZ rules that were not applied by an administrator
DNS query anomalies or traffic redirection through unexpected upstream hosts

Detection Strategies

Inspect network traffic to and from the router's management interface for suspicious HTTP requests targeting DMZ configuration parameters
Correlate router administrative activity with authenticated user sessions to identify unauthenticated changes
Monitor for atypical protocols or services originating from the router itself, such as outbound shells or file transfers

Monitoring Recommendations

Aggregate router syslog and network flow data into a centralized analytics platform for continuous review
Alert on any change to DMZ, port forwarding, or firewall configuration outside approved maintenance windows
Perform periodic firmware version audits of network edge devices to confirm patch levels

How to Mitigate CVE-2026-71986

Immediate Actions Required

Restrict access to the router's web management interface to trusted internal management VLANs only
Disable remote WAN administration if it is currently enabled
Disable the DMZ feature until a vendor patch is available and applied
Rotate administrative credentials and review the router configuration for unauthorized changes

Patch Information

At the time of publication, no fixed firmware version has been listed in the NVD entry. Administrators should monitor the MSI Support Page for firmware updates and apply the vendor patch as soon as it is released.

Workarounds

Place the router behind an upstream firewall that blocks external access to management ports
Segment the router management interface onto a dedicated administrative network
Disable the DMZ function through the web UI until a firmware update addresses the injection flaw
Replace affected devices in high-risk environments with hardware that has received a security update

bash

# Configuration example: block external access to router management interface
# Example iptables rule applied on an upstream firewall
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP

# Allow management only from a trusted subnet
iptables -I FORWARD -s 10.10.10.0/24 -p tcp -d <router_ip> --dport 443 -j ACCEPT