CVE-2026-71984 in Radix AXE6600
Summary
by MITRE • 08/09/2026
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the urlfilter function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the urlfilter function to inject malicious commands and obtain root privileges on the underlying system.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/09/2026
The MSIRadix AXE6600 router represents a significant cybersecurity vulnerability through its command injection flaw within the urlfilter function of firmware version v781521. This vulnerability stems from inadequate input validation mechanisms that fail to properly sanitize user-supplied data before processing within the router's command execution environment. The absence of proper filtering and sanitization allows malicious actors to inject arbitrary commands directly into the system through the vulnerable urlfilter interface, creating a critical pathway for unauthorized system access.
The technical exploitation of this vulnerability operates through a classic command injection attack vector where attacker-controlled input is concatenated with system commands without proper escaping or validation. When the urlfilter function processes user-provided parameters, it fails to implement adequate sanitization measures that would prevent malicious command sequences from being executed within the router's shell environment. This flaw directly violates established security principles and creates a persistent backdoor for attackers to gain full administrative control over the device.
The operational impact of this vulnerability extends far beyond simple unauthorized access, as successful exploitation grants attackers root privileges on the underlying operating system. This elevated access level enables comprehensive system compromise including but not limited to network traffic interception, modification of firewall rules, installation of persistent malware, and complete network infiltration. The vulnerability affects all users of firmware version v781521 regardless of their network configuration or security awareness levels, making it particularly dangerous in enterprise environments where routers serve as critical network infrastructure components.
Security standards such as CWE-77 and CWE-94 directly apply to this vulnerability, categorizing it as a command injection flaw that allows arbitrary code execution. The ATT&CK framework would classify this as T1059.001 - Command and Scripting Interpreter with techniques involving remote access and privilege escalation. Organizations should immediately implement network segmentation to isolate affected devices, disable unnecessary services, and establish monitoring for suspicious command execution patterns. Firmware updates from the vendor represent the primary mitigation strategy, while temporary workarounds may include implementing firewall rules that block unauthorized access to the vulnerable urlfilter interface.