CVE-2026-71985 in Radix AXE6600
Summary
by MITRE • 08/09/2026
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the accesscontrol function to execute malicious commands and obtain root privileges on the underlying system.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/09/2026
This vulnerability represents a critical command injection flaw within the MSI Radix AXE6600 router firmware version v781521, specifically affecting the accesscontrol function implementation. The flaw stems from inadequate input validation and sanitization mechanisms that fail to properly filter user-supplied data before incorporating it into system commands. According to CWE-77, this vulnerability classifies as a direct injection attack where attacker-controlled data is executed as shell commands, enabling arbitrary code execution on the affected device. The vulnerability exists at the application layer within the router's web interface, making it accessible through standard network protocols without requiring physical access or elevated privileges.
The technical exploitation of this command injection vulnerability allows remote attackers to manipulate the accesscontrol function by injecting malicious command sequences into input parameters. When the router processes these malformed inputs, the system interprets and executes the injected commands with the highest privilege level available, typically root or administrator permissions. This privilege escalation occurs because the vulnerable function does not properly isolate user input from system command execution contexts. Attackers can leverage this vulnerability to execute arbitrary code on the device, potentially leading to complete system compromise including data exfiltration, persistent backdoor installation, and network reconnaissance activities.
The operational impact of this vulnerability extends beyond simple remote code execution, creating significant risks for both individual users and enterprise networks. Once compromised, the router becomes a potential pivot point for attackers to launch lateral movement attacks against internal network segments, as routers often serve as critical network boundary devices. The vulnerability affects the fundamental security posture of connected networks since compromised routers can be used to intercept traffic, modify network configurations, or serve as command and control centers for larger attack campaigns. This aligns with ATT&CK technique T1059.001 for Command and Scripting Interpreter and T1021.001 for Remote Services, demonstrating how the vulnerability enables attackers to establish persistent access and execute malicious activities within network environments.
Mitigation strategies should focus on immediate firmware updates from MSI to address the underlying command injection flaw through proper input validation and sanitization mechanisms. Network administrators must implement strict access controls limiting administrative interface access to trusted networks only, while also deploying intrusion detection systems to monitor for suspicious command execution patterns. The vulnerability highlights the importance of secure coding practices and input validation as outlined in OWASP Top Ten A03:2021 and NIST SP 800-53 CM-7 requirements for configuration management and system security. Organizations should also consider network segmentation to limit the blast radius of potential compromises, along with regular vulnerability assessments to identify similar issues in other network infrastructure components that may be similarly vulnerable to command injection attacks through inadequate input validation processes.