CVE-2026-71992: MSI Radix AXE6600 Router RCE Vulnerability

CVE-2026-71992 Overview

CVE-2026-71992 is a command injection vulnerability affecting the MSI Radix AXE6600 Wi-Fi 6E gaming router running firmware version v781521. The flaw resides in the macfilter function of the router's web management interface. Remote attackers can inject operating system commands through this function without authentication. Successful exploitation grants root privileges on the underlying Linux-based firmware. The weakness is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command. The Exploit Prediction Scoring System (EPSS) reports a probability of 1.35% with a percentile ranking of 69.039.

Critical Impact
Unauthenticated remote attackers can execute arbitrary commands as root on affected MSI Radix AXE6600 routers, enabling full device compromise, traffic interception, and pivoting into internal networks.

Affected Products

MSI Radix AXE6600 Wi-Fi 6E Tri-Band Gaming Router
Firmware version v781521
Router web management interface (macfilter function)

Discovery Timeline

2026-08-09 - CVE-2026-71992 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-71992

Vulnerability Analysis

The vulnerability exists in the MAC address filtering feature of the MSI Radix AXE6600 router. The macfilter function accepts user-supplied input from the web administration interface and passes it to an underlying shell command without proper sanitization. Because the router runs the web interface with root privileges, injected commands inherit full administrative control of the device.

Remote attackers reachable on the router's management interface can craft HTTP requests containing shell metacharacters. The vulnerable handler concatenates these values into a system command string. The operating system shell then interprets the metacharacters, executing attacker-controlled payloads alongside the intended command.

Successful exploitation delivers persistent root access. Attackers can modify firewall rules, install backdoors, intercept LAN traffic, harvest credentials, and pivot laterally into networks connected to the router.

Root Cause

The root cause is the absence of input validation and neutralization within the macfilter handler. User-controlled parameters are inserted directly into an operating system command executed by a shell interpreter. Standard defensive measures such as argument-array execution, allowlist filtering of MAC address syntax, or escaping of shell metacharacters are not applied.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted request to the router's management interface targeting the macfilter endpoint. Shell metacharacters embedded in the MAC filter parameter break out of the intended command context. The vulnerability is reachable from any network segment where the management interface is exposed, including LAN clients and, in misconfigured deployments, the WAN interface.

No verified public exploitation code has been released. Technical details are documented in the VulnCheck Advisory: MSI RadiX AXE6600 Command Injection.

Detection Methods for CVE-2026-71992

Indicators of Compromise

Unexpected outbound connections originating from the router's WAN interface to unfamiliar IP addresses
Modified firewall, DNS, or routing configurations on the AXE6600 that were not made administratively
HTTP POST requests to router management endpoints containing shell metacharacters such as ;, |, &, backticks, or $() within MAC filter parameters
New or unknown processes running on the router, or anomalous CPU usage on the embedded device

Detection Strategies

Inspect network traffic to the router's management interface for HTTP requests containing shell metacharacters in macfilter-related parameters
Monitor DNS query logs for anomalous domains resolved by the router itself rather than by client devices
Baseline router configuration and alert on unauthorized changes to firewall, port forwarding, or administrative account settings

Monitoring Recommendations

Restrict and log all administrative access attempts to the router web interface, including source IP, timestamp, and requested URI
Deploy network intrusion detection signatures that flag command injection patterns in HTTP requests to consumer router endpoints
Continuously monitor for firmware version and configuration drift on all edge networking equipment

How to Mitigate CVE-2026-71992

Immediate Actions Required

Disable remote (WAN-side) administration on the MSI Radix AXE6600 immediately
Restrict access to the router's management interface to a limited administrative subnet or single trusted host
Change all administrative credentials and audit configuration for unauthorized modifications
Segment the router from sensitive internal assets until a firmware patch is applied

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for firmware version v781521. Administrators should monitor the MSI RadiX AXE6600 Support Page for firmware updates and apply them promptly upon release. Details are available in the VulnCheck Advisory.

Workarounds

Disable the MAC address filtering feature until an updated firmware version is available
Place the router behind a separately managed firewall that filters access to its management interface
Replace the affected device with a supported and actively patched router in high-risk environments

bash

# Example: restrict router management access to a single admin host using an upstream firewall
# Replace 192.0.2.10 with the trusted admin IP and 192.168.1.1 with the router IP
iptables -A FORWARD -s 192.0.2.10 -d 192.168.1.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 443 -j DROP