CVE-2026-71986 in Radix AXE6600
Summary
by MITRE • 08/09/2026
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the dmz function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the dmz function to execute malicious commands and obtain root privileges on the underlying system.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/09/2026
This vulnerability represents a critical command injection flaw within the management interface of the MSI Radix AXE6600 router firmware version v781521. The issue specifically resides in the dmz function implementation, where insufficient input validation allows attackers to inject malicious commands that are subsequently executed with elevated privileges. The vulnerability stems from improper sanitization of user-supplied parameters passed to system commands, creating an environment where arbitrary code execution becomes possible without authentication. This flaw directly violates security principles outlined in cwe-77 and cwe-88, which categorize command injection as a fundamental weakness in software design that enables attackers to execute unintended commands on the target system.
The operational impact of this vulnerability is severe as it provides remote attackers with complete administrative control over the affected device. Once exploited, attackers can gain root privileges and execute any command available within the router's operating system environment. This level of access enables comprehensive network reconnaissance, modification of firewall rules, redirection of traffic through malicious proxies, and potential use as a pivot point for attacking other devices within the local network. The attack surface extends beyond simple command execution to include persistent backdoor establishment, data exfiltration capabilities, and denial of service conditions that can disrupt network operations.
Security professionals should recognize this vulnerability in the context of the mitre att&ck framework where it maps to techniques such as command and control through remote access, privilege escalation, and persistence mechanisms. The vulnerability's exploitation requires no special privileges or authentication credentials, making it particularly dangerous for unpatched devices accessible from the internet. Organizations should implement immediate network segmentation measures to isolate affected devices while developing patches and temporary workarounds. Recommended mitigations include disabling the dmz function if not required, implementing firewall rules that restrict access to administrative interfaces, and monitoring for unusual network traffic patterns that might indicate exploitation attempts.
The broader implications of this vulnerability highlight the critical importance of firmware security in consumer networking equipment where regular updates are often neglected by end users. Many devices remain unpatched for extended periods, creating persistent attack vectors within home and small office networks. This particular flaw demonstrates how seemingly simple functions like dmz configuration can contain complex security implications when proper input validation is omitted. Network administrators should establish comprehensive inventory systems to track all network devices and their firmware versions, ensuring timely patch management and vulnerability assessment programs that include network infrastructure components beyond traditional computing systems.