CVE-2026-71990: MSI Radix AXE6600 Router RCE Vulnerability

CVE-2026-71990 Overview

CVE-2026-71990 is a command injection vulnerability affecting MSI Radix AXE6600 router firmware version v781521. The flaw resides in the TelnetSSH function used for SSH configuration. Remote attackers can inject arbitrary operating system commands through the SSH configuration interface and obtain root privileges on the underlying system. The vulnerability is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command. The Exploit Prediction Scoring System (EPSS) rates this issue at 1.35% probability with a 69.041 percentile ranking as of 2026-08-14.

Critical Impact
Successful exploitation grants remote attackers root-level command execution on affected MSI Radix AXE6600 routers, enabling full device compromise and pivoting into connected networks.

Affected Products

MSI Radix AXE6600 WiFi 6E Tri-Band Gaming Router
Firmware version v781521
SSH configuration interface exposing the TelnetSSH function

Discovery Timeline

2026-08-09 - CVE-2026-71990 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-71990

Vulnerability Analysis

The vulnerability exists in the TelnetSSH function responsible for handling SSH configuration on the MSI Radix AXE6600 router. The function fails to sanitize user-supplied input before passing it to an operating system command interpreter. Attackers who can reach the SSH configuration interface can append shell metacharacters to legitimate configuration parameters. The injected payload executes with the privileges of the process handling SSH configuration, which runs as root on the device.

Because the router firmware processes these commands with elevated privileges, exploitation results in complete device takeover. An attacker can modify firmware, extract stored credentials, monitor network traffic, or use the router as a foothold inside the target network. The vulnerability maps to [CWE-78], the standard classification for OS command injection.

Root Cause

The root cause is missing input neutralization in the TelnetSSH function. Parameters submitted through the SSH configuration workflow are concatenated directly into a shell command string. The firmware does not enforce an allow-list, escape shell metacharacters, or use safe process-execution APIs that separate the command from its arguments. This design allows any character sequence that a shell interprets — such as ;, &&, |, or backticks — to break out of the intended command context.

Attack Vector

Exploitation is performed remotely over the network against the router's administrative interface. An attacker interacts with the SSH configuration endpoint and submits crafted values into fields consumed by the TelnetSSH function. The injected shell operators cause the router to execute arbitrary commands as root. Refer to the VulnCheck Advisory: MSI Command Injection for further technical detail on the injection point.

// No verified public proof-of-concept code is available.
// Vulnerability class: OS command injection via unsanitized parameters
// passed to a shell interpreter by the TelnetSSH configuration handler.

Detection Methods for CVE-2026-71990

Indicators of Compromise

Unexpected outbound connections initiated by the router to unfamiliar external hosts.
New or modified accounts, SSH keys, or startup scripts on the router file system.
Router administrative logs showing SSH configuration changes from unrecognized source addresses.
Presence of shell metacharacters such as ;, &&, or backticks in captured administrative request payloads.

Detection Strategies

Inspect HTTP or API requests targeting the SSH configuration endpoint for shell metacharacters in parameter values.
Correlate router administrative traffic with process-execution or DNS anomalies observed on downstream endpoints.
Alert on router configuration changes that occur outside approved change-management windows.

Monitoring Recommendations

Forward router syslog and administrative event logs to a centralized analytics platform for review.
Monitor internal network segments for lateral movement originating from the router's management IP address.
Track firmware version and configuration integrity across all MSI Radix AXE6600 devices in the environment.

How to Mitigate CVE-2026-71990

Immediate Actions Required

Restrict administrative access to the router to trusted management networks only, and disable remote administrative exposure to the internet.
Rotate all administrative credentials and SSH keys on affected devices.
Audit the SSH configuration and firmware integrity of each MSI Radix AXE6600 running version v781521.

Patch Information

No vendor-issued patch is referenced in the current advisory data. Consult MSI RadiX AXE6600 Support for firmware release announcements. Apply any updated firmware from the MSI Official Website as soon as it becomes available and confirms remediation of the TelnetSSH command injection.

Workarounds

Disable the SSH configuration interface if it is not required for operations.
Place the router management interface behind a firewall or VPN and enforce source-IP allow-lists.
Segment the router from sensitive internal assets to limit blast radius if exploitation occurs.

bash

# Example: restrict router management interface to a trusted subnet
# (apply on an upstream firewall, not on the vulnerable device)
iptables -A FORWARD -p tcp -d <router_mgmt_ip> --dport 22 \
  -s 10.0.10.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <router_mgmt_ip> --dport 22 -j DROP