CVE-2026-71993: MSI Radix AXE6600 Router RCE Vulnerability

CVE-2026-71993 Overview

CVE-2026-71993 is a command injection vulnerability [CWE-78] affecting MSI Radix AXE6600 router firmware version v781521. The flaw resides in the openvpn function and allows remote attackers to execute arbitrary commands on the affected device. Attackers can also leverage the macfilter function to inject malicious commands and obtain root privileges on the underlying Linux system.

The vulnerability is network-exploitable, requires no authentication, and grants full compromise of confidentiality, integrity, and availability on the router.

Critical Impact
Unauthenticated remote attackers can achieve root-level command execution on affected MSI Radix AXE6600 routers, enabling full device takeover and pivoting into internal networks.

Affected Products

MSI Radix AXE6600 WiFi 6E Tri-Band Gaming Router
MSI Radix AXE6600 firmware version v781521
Router deployments exposing management or OpenVPN interfaces to untrusted networks

Discovery Timeline

2026-08-09 - CVE-2026-71993 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-71993

Vulnerability Analysis

The vulnerability is classified as OS Command Injection [CWE-78]. It exists in the router's openvpn handler, which processes user-supplied input and passes it into a shell context without adequate sanitization. Because the injected commands run within the router's system shell, attackers gain execution as the root user.

An adjacent injection point resides in the macfilter function. This handler accepts MAC address parameters that are concatenated into shell commands used to update firewall or filtering rules. Attackers weaponize the macfilter path to achieve the same root-level execution.

Because the AXE6600 is a consumer and small-office gaming router, compromise gives attackers a persistent foothold at the network edge. From there, adversaries can intercept traffic, tamper with DNS resolution, deploy botnet payloads, or pivot into connected internal hosts.

Root Cause

The root cause is the concatenation of attacker-controlled input into shell command strings inside the openvpn and macfilter handlers without input validation, allow-listing, or safe process-execution APIs. Shell metacharacters such as ;, |, &&, and backticks are not filtered, allowing command chaining.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted HTTP request to the router's management interface targeting the vulnerable openvpn or macfilter endpoint. The malicious payload is embedded in a request parameter that the firmware passes into a shell execution routine, resulting in arbitrary command execution as root. Refer to the VulnCheck Advisory #V781521 for endpoint specifics.

Detection Methods for CVE-2026-71993

Indicators of Compromise

Unexpected outbound connections originating from the router to unknown IP addresses, particularly on non-standard ports.
HTTP requests to the router management interface containing shell metacharacters such as ;, |, $(, or backticks in openvpn or macfilter parameters.
Unauthorized changes to router configuration, DNS settings, firewall rules, or firmware.
Presence of unfamiliar processes, cron jobs, or binaries on the router filesystem.

Detection Strategies

Inspect web proxy or NetFlow logs for administrative HTTP or HTTPS requests to the router that contain URL-encoded shell metacharacters targeting the OpenVPN or MAC filter configuration paths.
Monitor for anomalous DNS traffic sourced from the router itself, which often signals a compromised edge device beaconing to command-and-control infrastructure.
Correlate router configuration changes with authenticated administrator sessions to identify unauthorized modifications.

Monitoring Recommendations

Forward router syslog and administrative access logs to a centralized SIEM for retention and correlation.
Alert on any successful authentication or configuration change from an external or unexpected internal IP address.
Baseline outbound traffic volumes from network gateways and alert on statistical deviations.

How to Mitigate CVE-2026-71993

Immediate Actions Required

Restrict access to the router's web management and OpenVPN interfaces to trusted internal management VLANs only. Disable WAN-side administration.
Change all default and administrator credentials on the device and rotate any pre-shared keys used by OpenVPN.
Audit the router for signs of compromise, including unfamiliar processes, modified DNS servers, and unauthorized firewall rules. Factory reset devices suspected of compromise before restoring configuration.
Segment the router from sensitive internal assets until a vendor patch is applied.

Patch Information

At the time of publication, no vendor advisory or fixed firmware release is referenced in the NVD entry. Monitor the MSI RadiX AXE6600 Support page for firmware updates superseding version v781521 and apply them as soon as they become available.

Workarounds

Disable the OpenVPN server feature on the router if it is not required for business operations.
Block inbound access to the router management interface at the perimeter and require VPN access from a hardened jump host for administration.
Place the router behind an upstream firewall that inspects HTTP requests for shell metacharacters targeting known vulnerable parameter names.

bash

# Example: restrict router management access at an upstream firewall (iptables)
iptables -A FORWARD -p tcp -d <ROUTER_MGMT_IP> --dport 443 -s <TRUSTED_MGMT_SUBNET> -j ACCEPT
iptables -A FORWARD -p tcp -d <ROUTER_MGMT_IP> --dport 443 -j DROP
iptables -A FORWARD -p tcp -d <ROUTER_MGMT_IP> --dport 80  -j DROP