CVE-2026-71987 in Radix AXE6600
Summary
by MITRE • 08/09/2026
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the alg function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/09/2026
The MSi Radix AXE6600 router represents a significant cybersecurity concern due to a critical command injection vulnerability embedded within its firmware version v781521. This flaw exists within the application layer gateway functionality, specifically in the alg function that handles protocol translation and network traffic management. The vulnerability stems from inadequate input validation and sanitization mechanisms that fail to properly filter malicious payloads submitted through the affected interface. Security researchers have identified that this issue creates a direct pathway for remote code execution attacks, allowing unauthorized actors to bypass normal authentication mechanisms and gain administrative control over the device.
The technical exploitation of this command injection flaw occurs when attackers submit specially crafted inputs to the alg function through network requests targeting the router's web interface or API endpoints. The vulnerability manifests as a classic os command injection vector where user-supplied data is directly concatenated into system commands without proper escaping or encoding. This allows threat actors to append malicious shell commands that execute with the highest privilege level available within the router's operating environment, typically root or administrator privileges. The attack surface extends beyond simple command execution to include potential lateral movement and persistence mechanisms within network environments where the device operates.
The operational impact of this vulnerability presents substantial risk to organizations relying on the MSi Radix AXE6600 for network infrastructure management. Remote attackers can leverage this weakness to establish persistent backdoors, redirect network traffic, modify firewall rules, or exfiltrate sensitive data from connected networks. The compromised device becomes a potential pivot point for attackers to target internal systems, escalate privileges across multiple network segments, and maintain long-term access to otherwise protected environments. This vulnerability directly aligns with CWE-77 and CWE-94 categories related to command injection and code execution flaws, and maps to attack techniques described in the MITRE ATT&CK framework under T1059 for command and scripting interpreter and T1021 for remote services.
Mitigation strategies for this vulnerability require immediate firmware updates from MSI addressing the specific command injection flaw within the alg function. Network administrators should implement network segmentation and access controls to limit exposure of affected devices to untrusted networks. Additional defensive measures include monitoring network traffic for suspicious command execution patterns, implementing intrusion detection systems with signature-based detection for known exploit payloads, and disabling unnecessary services or ports on the device. Organizations should also conduct comprehensive network assessments to identify other potentially vulnerable devices using similar firmware versions or architectures. Regular vulnerability scanning and security audits remain essential for maintaining network hygiene, particularly given the persistent nature of such flaws in networking equipment where patch management may be limited or delayed.