CVE-2026-71991: MSI Radix AXE6600 Router RCE Vulnerability

CVE-2026-71991 Overview

CVE-2026-71991 is a command injection vulnerability affecting the MSI Radix AXE6600 Wi-Fi 6E gaming router running firmware version v781521. The flaw resides in the TelnetSSH function used for Telnet configuration and permits remote, unauthenticated attackers to inject arbitrary operating system commands. Successful exploitation yields root privileges on the underlying Linux system, giving attackers full control of the device. The weakness is categorized as CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Unauthenticated remote attackers can execute arbitrary commands as root on MSI Radix AXE6600 routers running firmware v781521, enabling complete device takeover, traffic interception, and lateral movement into connected networks.

Affected Products

MSI Radix AXE6600 Wi-Fi 6E Tri-Band Gaming Router
Firmware version v781521
TelnetSSH function within the Telnet configuration interface

Discovery Timeline

2026-08-09 - CVE-2026-71991 published to the National Vulnerability Database
2026-08-09 - Last updated in NVD database
2026-08-14 - EPSS score published at 1.35% (69.04 percentile)

Technical Details for CVE-2026-71991

Vulnerability Analysis

The vulnerability exists in the TelnetSSH handler responsible for processing Telnet configuration parameters on the MSI Radix AXE6600 router. User-supplied input reaches an operating system command execution path without adequate sanitization or neutralization of shell metacharacters. As a result, an attacker can append or embed shell commands within an otherwise legitimate configuration request. The router executes these injected commands under the privileges of the web management process, which runs as root on the underlying firmware. This class of flaw (CWE-78) is common in consumer and small-office network appliances that pass configuration parameters directly to shell utilities such as system() or backtick invocations. Refer to the VulnCheck Advisory for MSI Command Injection for additional context.

Root Cause

The root cause is missing input validation in the TelnetSSH function. Parameters submitted to the Telnet configuration endpoint are concatenated into a shell command string without escaping metacharacters such as ;, |, &, or backticks. Any request that reaches this handler can therefore break out of the intended command context.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with network reachability to the router's management interface sends a crafted request to the Telnet configuration endpoint. The injected payload is executed as root, allowing arbitrary command execution, credential extraction, firmware modification, and persistent implant installation.

No verified public proof-of-concept exploit code is available at this time. Technical specifics of the payload structure are documented in the VulnCheck Advisory for MSI Command Injection.

Detection Methods for CVE-2026-71991

Indicators of Compromise

Unexpected Telnet or SSH daemons listening on non-standard ports after configuration changes to the router.
Outbound connections from the router to unknown hosts, particularly on ports commonly used by reverse shells or botnet command-and-control.
Unauthorized changes to router administrator credentials, DNS settings, or firmware images.
Presence of shell metacharacters such as ;, |, or backticks in Telnet configuration request logs.

Detection Strategies

Inspect HTTP requests to the router's Telnet configuration endpoint for shell metacharacters or command sequences within parameter values.
Monitor network traffic from routers for anomalous outbound connections, DNS queries to newly registered domains, or unexpected tunneling activity.
Correlate authentication anomalies on internal hosts with router traffic patterns to identify post-exploitation lateral movement.

Monitoring Recommendations

Ingest router syslog and network flow data into a centralized analytics platform for continuous behavioral analysis.
Alert on new listening services or configuration changes on edge networking devices.
Track EPSS trend data for CVE-2026-71991; the current score is 1.35% at the 69.04 percentile as of 2026-08-14.

How to Mitigate CVE-2026-71991

Immediate Actions Required

Restrict management access to the MSI Radix AXE6600 to trusted internal networks only; block Telnet and web administration from the WAN interface.
Disable the Telnet service on the router if not required for operations.
Rotate all administrative credentials on the router and connected infrastructure.
Audit connected clients and network segments for signs of compromise or unauthorized configuration changes.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry. Consult the MSI RadiX AXE6600 Support page for firmware updates newer than v781521 and apply them as soon as they become available.

Workarounds

Place the router management interface behind a network segment reachable only through VPN or jump host.
Disable remote administration and the Telnet configuration feature until a fixed firmware release is available.
Deploy an intrusion prevention system rule that blocks HTTP requests containing shell metacharacters targeting the router's Telnet configuration endpoint.

bash

# Configuration example: block WAN-side access to router management with iptables on an upstream gateway
iptables -A FORWARD -d <ROUTER_WAN_IP> -p tcp --dport 23 -j DROP
iptables -A FORWARD -d <ROUTER_WAN_IP> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <ROUTER_WAN_IP> -p tcp --dport 443 -j DROP