CVE-2026-71989 in Radix AXE6600
Summary
by MITRE • 08/09/2026
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the porTrigger function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/09/2026
The vulnerability identified in MSI Radix AXE6600 router firmware version v781521 represents a critical command injection flaw within the porTrigger function that exposes the device to remote exploitation. This security weakness resides in the router's web management interface where user-supplied input is improperly validated and directly incorporated into system commands without adequate sanitization measures. The vulnerability stems from insufficient input validation mechanisms that fail to properly filter or escape special characters that could alter the intended execution flow of shell commands.
The technical implementation of this flaw allows attackers to manipulate the alg function parameter to inject malicious commands that are subsequently executed with elevated privileges. When an attacker submits crafted input through the vulnerable porTrigger function, the system processes the request without proper sanitization, enabling arbitrary command execution capabilities. This vulnerability directly enables privilege escalation from standard user access to root-level system control, providing attackers with complete administrative access to the router's underlying operating system.
The operational impact of this vulnerability extends beyond simple remote code execution as it fundamentally compromises the router's security posture and network integrity. Attackers can leverage this vulnerability to establish persistent backdoors, modify network configurations, intercept traffic, or use the compromised device as a pivot point for further attacks within the local network. The ability to execute commands with root privileges means that attackers can manipulate system files, install malicious software, disable security features, or completely compromise the device's functionality.
This vulnerability aligns with CWE-77 and CWE-94 categories, specifically addressing command injection weaknesses that enable arbitrary code execution through improper input handling and insufficient sanitization of user-supplied data. The attack surface is consistent with ATT&CK technique T1059.001 for command and scripting interpreter, where adversaries execute commands through legitimate system interfaces. Network infrastructure devices like routers represent high-value targets in attack chains due to their privileged position and access to internal network resources.
Mitigation strategies should include immediate firmware updates from MSI to address the identified vulnerability, implementing network segmentation to limit exposure, and deploying intrusion detection systems to monitor for suspicious command execution patterns. Organizations should also consider disabling unnecessary web management interfaces, restricting access to administrative functions through firewall rules, and regularly auditing router configurations for unauthorized modifications. Additionally, implementing proper input validation controls and output encoding mechanisms within the application code can prevent similar vulnerabilities from occurring in future deployments.