A command injection flaw in the MSI Radix AXE6600's dmz function lets unauthenticated remote attackers run arbitrary commands as root on the device.
What Is It
CVE-2026-71986 is an OS command injection vulnerability (CWE-78) in MSI Radix AXE6600 router firmware version v781521. The flaw resides in the router's dmz function, which fails to properly sanitize input before passing it to the underlying system. Remote attackers can inject malicious commands through this function and execute them on the affected device, reportedly obtaining root privileges on the underlying system.
The vulnerability was disclosed by VulnCheck and carries a CVSS v3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A CVSS v4.0 score of 9.3 (CRITICAL) is also assigned.
Why It Matters
The scoring vector tells the story: network attack vector, low attack complexity, no privileges required, and no user interaction. There is no authentication barrier and no victim action needed; an attacker who can reach the device can exploit it directly.
Per the advisory, successful exploitation yields root on the router. If that holds, it implies full confidentiality, integrity, and availability impact on the device itself, the CVSS v3.1 vector scores all three as High, opening the door to traffic interception, DNS manipulation, persistent implants, and pivoting into the network segment behind the router. Consumer and gaming routers are frequently internet-facing and infrequently patched, which widens the practical exposure window.
Note: this CVE does not appear in the CISA KEV catalog based on the supplied data. There is no confirmed active exploitation on record, and the NVD exploit maturity field is NOT_DEFINED.
What's Vulnerable
- Vendor: MSI
- Product: Radix AXE6600 (WiFi 6E Tri-Band Gaming Router)
- Affected versions: firmware v781521 is the only version named in the advisory data; earlier firmware may also be affected, but no confirmed version range has been published
- Component: the
dmzfunction
Patch Status
No patched version is identified in the supplied advisory data, and no CISA-mandated remediation deadline applies since the CVE is not in KEV. The record status in the supplied NVD data is Received, meaning NVD analysis is still pending and the details above may change. Administrators should check the MSI Radix AXE6600 support page for firmware updates and, in the interim, restrict remote management exposure and avoid using the DMZ feature on affected devices.