A critical command injection flaw in the MSI Radix AXE6600 gaming router's urlfilter function lets unauthenticated remote attackers run arbitrary commands as root.
What Is It
CVE-2026-71984 is an OS command injection vulnerability (CWE-78) in MSI Radix AXE6600 router firmware version v781521. The flaw lives in the urlfilter function, which fails to properly neutralize input before passing it to the underlying system. A remote attacker can inject malicious commands through that function and execute them on the device, obtaining root privileges on the underlying system.
The issue was disclosed via VulnCheck, which assigned a CVSS v3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A CVSS v4.0 score of 9.3 (Critical) was also assigned.
Why It Matters
Every exploitability condition here is at its worst value: network-reachable attack vector, low attack complexity, no privileges required, and no user interaction. There is no authentication gate and nothing a victim has to click.
The payoff matches the ease. Successful exploitation yields root on the router; full confidentiality, integrity, and availability impact. A compromised gateway sits in front of everything behind it, giving an attacker a position to observe traffic, alter device configuration, or disrupt connectivity for the entire network segment.
No CISA KEV entry was supplied for this CVE, so there is no confirmed evidence of active exploitation in the wild at this time. That is not a reason to deprioritize a 9.8 with zero preconditions.
What's Vulnerable
- Vendor: MSI
- Product: Radix AXE6600 (WiFi 6E Tri-Band Gaming Router)
- Affected firmware: v781521: the only version identified in the source material
- Vulnerable component: the
urlfilterfunction
The NVD record lists no CPE match data, and no unaffected or fixed version is identified in the source material. Because only v781521 is named, the status of earlier or later firmware builds is unestablished; treat other versions as unassessed rather than confirmed safe or confirmed vulnerable.
Patch Status
The supplied data does not identify a fixed firmware version or vendor patch, and no required remediation action was provided. The NVD record's status is "Received," meaning it is still awaiting full analysis. MSI's official product support page is listed as a reference and is the place to check for firmware updates. Until a fix is confirmed, restricting network access to the router's management interface is the only lever the source material supports.
Sources
- NVD, CVE-2026-71984: https://nvd.nist.gov/vuln/detail/CVE-2026-71984
- VulnCheck Advisory; MSI Radix AXE6600 v781521 Command Injection via urlfilter: https://www.vulncheck.com/advisories/msi-radix-axe6600-v781521-command-injection-via-urlfilter
- MSI Radix AXE6600 Product Support: https://us.msi.com/Networking/RadiX-AXE6600-WiFi-6E-Tri-Band-Gaming-Router/support
- MSI: https://www.msi.com/