CVE-2026-71983 in Radix AXE6600
Summary
by MITRE • 08/09/2026
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the wps.cgi interface that allows remote attackers to execute arbitrary commands by injecting malicious input through the pin2g, pin5g, or pin6g parameters. Attackers can exploit these unsanitized parameters to execute arbitrary commands on the affected device and obtain root privileges.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/09/2026
The vulnerability identified in MSI Radix AXE6600 router firmware version v781521 represents a critical command injection flaw within the web interface administration module. This issue manifests through the wps.cgi script which fails to properly sanitize user input parameters, specifically pin2g, pin5g, and pin6g. The absence of input validation creates an exploitable condition where malicious actors can inject arbitrary commands directly into the router's underlying operating system through these vulnerable parameters.
From a technical perspective, this command injection vulnerability stems from improper input handling within the web application layer of the router's firmware. When users submit data through the wps.cgi interface using the affected parameters, the system processes these inputs without adequate sanitization or validation mechanisms. The flaw aligns with CWE-77 which categorizes command injection vulnerabilities as those occurring when user-supplied data is directly incorporated into system commands without proper escaping or filtering. This vulnerability can be classified under the broader category of CWE-94 which encompasses code injection flaws where untrusted data is executed as code.
The operational impact of this vulnerability extends beyond simple privilege escalation to encompass complete system compromise. Attackers who successfully exploit this flaw can execute arbitrary commands with root privileges, effectively gaining full administrative control over the affected router. This level of access enables adversaries to modify network configurations, establish persistent backdoors, monitor network traffic, and potentially use the compromised device as a pivot point for attacking other systems within the local network. The vulnerability's remote exploitability means that attackers do not require physical access or network proximity to carry out successful attacks.
This vulnerability directly maps to several tactics outlined in the MITRE ATT&CK framework under the T1059 technique category, specifically Command and Scripting Interpreter. The ability to execute commands remotely on a device represents a significant threat vector for attackers seeking to establish persistent access within network environments. Additionally, this flaw contributes to broader attack chains involving privilege escalation and lateral movement within compromised networks. Organizations using affected MSI routers face potential exposure to advanced persistent threats that could leverage this vulnerability for extended periods without detection.
The recommended mitigations include immediate firmware updates from MSI to address the command injection vulnerability through proper input sanitization and validation mechanisms. Network administrators should also implement network segmentation strategies to limit the potential impact of such compromises. Additional protective measures include disabling unnecessary web interfaces when not actively required, implementing strict access controls for router management interfaces, and monitoring network traffic for suspicious activity patterns that might indicate exploitation attempts. The vulnerability demonstrates the critical importance of input validation in embedded systems and highlights the need for comprehensive security testing throughout the software development lifecycle of network infrastructure devices.