CVE-2026-71989: MSI Radix AXE6600 Router RCE Vulnerability

CVE-2026-71989 Overview

CVE-2026-71989 is a command injection vulnerability in the MSI Radix AXE6600 Wi-Fi 6E gaming router running firmware version v781521. The flaw resides in the porTrigger function and is reachable through the alg function. Remote, unauthenticated attackers can inject operating system commands and obtain root privileges on the underlying Linux system. The weakness is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Unauthenticated remote attackers can execute arbitrary commands as root on affected MSI Radix AXE6600 routers, resulting in full device compromise.

Affected Products

MSI Radix AXE6600 Wi-Fi 6E Tri-Band Gaming Router
Firmware version v781521
Devices exposing the vulnerable porTrigger handler on the management interface

Discovery Timeline

2026-08-09 - CVE-2026-71989 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-71989

Vulnerability Analysis

The vulnerability exists in the router's port trigger handling logic. The porTrigger function accepts attacker-controlled input and passes it into a shell context without sanitization or escaping. Because the router firmware executes these operations as root, any injected command runs with the highest system privileges. The EPSS score of 1.35% (69th percentile) indicates measurable interest in exploitation relative to other disclosed vulnerabilities.

The issue is reachable through the alg (application layer gateway) function, which forwards user-supplied parameters into porTrigger. This chain expands the attack surface because alg processes traffic tied to NAT traversal and port-related configuration. Attackers do not need credentials, user interaction, or prior access to the network to trigger the flaw.

Root Cause

The root cause is improper neutralization of shell metacharacters in parameters processed by the porTrigger function. Input passes to an OS command interpreter without allow-list validation or argument quoting. Shell separators such as ;, &&, |, and backticks are interpreted by the underlying shell, letting attackers append arbitrary commands to the intended operation.

Attack Vector

The attack vector is network-based with low complexity and no privileges required. An attacker sends a crafted HTTP request to the router's management interface, targeting the alg endpoint that reaches porTrigger. The injected payload runs in the shell context of the web server process, which operates as root. Successful exploitation yields command execution, persistence via startup script modification, credential theft, firmware backdooring, or pivoting into the internal network. See the VulnCheck MSI Command Injection Advisory for a technical breakdown.

// No verified proof-of-concept code is published.
// Refer to the VulnCheck advisory for exploitation specifics.

Detection Methods for CVE-2026-71989

Indicators of Compromise

Outbound connections from the router to unknown IP addresses, especially over TCP/80, TCP/443, or non-standard high ports
Unexpected processes such as wget, curl, tftp, nc, or busybox invocations spawned by the web management daemon
Modifications to persistent configuration files or startup scripts on the router filesystem
HTTP requests to alg or port trigger endpoints containing shell metacharacters (;, |, &&, backticks, $())

Detection Strategies

Inspect router HTTP access logs for anomalous parameters submitted to port trigger and ALG configuration handlers
Monitor network telemetry for internal-to-external traffic originating from the router itself, which should be rare in normal operation
Correlate DNS queries and outbound flows from the router's management IP against known malicious infrastructure feeds

Monitoring Recommendations

Ingest firewall and switch logs adjacent to the router into a SIEM or data lake for centralized query and retention
Alert on new administrative sessions or configuration changes to the router occurring outside maintenance windows
Baseline the router's normal outbound connection profile and flag deviations for investigation

How to Mitigate CVE-2026-71989

Immediate Actions Required

Restrict access to the router's web management interface to trusted internal management VLANs only
Disable remote (WAN-side) administration and any UPnP or ALG features that are not required
Rotate administrative credentials and audit configured port triggers for unauthorized entries
Isolate affected routers from sensitive network segments until a vendor patch is applied

Patch Information

At the time of publication, no fixed firmware version has been listed in the NVD entry. Monitor the MSI Radix AXE6600 Support Page for updated firmware releases and apply the vendor patch as soon as it becomes available. Verify firmware integrity through vendor-provided checksums before installation.

Workarounds

Place the router behind an upstream firewall that blocks unsolicited inbound traffic to the management interface
Disable the ALG feature if it is not required for the environment, removing the reachable path to porTrigger
Segment IoT and consumer networking equipment onto dedicated VLANs with strict egress filtering

bash

# Example: block inbound access to router management ports from untrusted networks
iptables -A INPUT -p tcp --dport 80 -s <trusted_mgmt_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s <trusted_mgmt_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP