External risk intelligence

MSI Radix AXE6600 Command Injection via WPS Interface

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71983

The vulnerability resides in the web interface of a network router, specifically within the WPS configuration parameters. Routers of this type are frequently deployed as internet-facing edge gateways, and management interfaces or WPS-related services are often accessible or exposed in standard home and small office network configurations.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A command injection vulnerability has been identified in the web interface of a specific router model. This flaw allows unauthorized execution of commands on the affected device, potentially leading to elevated privileges. The main concern is confirming whether this technology is deployed and accessible within your environment.

Unsanitized input allows remote command execution.
Leadership must ensure awareness of network device security.
Verify if this router model is in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit a command injection vulnerability in the router's WPS interface without needing any special access or authentication. By sending specially crafted input through specific parameters in the WPS configuration, an attacker can execute arbitrary commands on the device. This could lead to the attacker gaining full control of the router and potentially using it to launch further attacks.

No authentication or special access required.
Malicious input to WPS parameters.
Full device control and privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an attacker could execute arbitrary commands on the affected router through its WPS interface, potentially leading to root privileges on the device.

Router command execution and root access.
Malicious input via WPS parameters.
Complete device compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The MSI Radix AXE6600 router firmware contains a critical command injection vulnerability that allows remote attackers to execute arbitrary code and gain root privileges. Given that this is a network router, the first practical move is to identify all deployed instances, confirm their exposure to the internet, and determine business criticality. The platform or infrastructure team, in coordination with the security team, should then identify the accountable owner and plan remediation based on the assessed risk.

Identify router owners.
Verify external reachability.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the MSI Radix AXE6600?

The MSI Radix AXE6600 is a tri-band Wi-Fi 6E gaming router designed to manage high-speed wireless traffic for home and small office networks. It acts as a central gateway, connecting local devices to the internet. The affected firmware, version v781521, includes an integrated web-based management interface used to configure wireless settings, including Wi-Fi Protected Setup (WPS) features, which are the focal point of this vulnerability.

How does this CVE-2026-71983 command injection work?

This vulnerability is classified as CWE-78, which concerns the improper neutralization of special elements used in an OS command. In this case, the router's web interface fails to validate input before processing it. By sending malicious data through specific parameters in the WPS configuration page, an attacker can trick the system into executing unauthorized operating system commands with root-level privileges.

Do I need to be authenticated to trigger this bug?

No. The flaw does not require any prior authentication or special user access to the device. An attacker can initiate the exploit remotely by sending crafted requests to the WPS interface. It is important to note that sending requests to unrelated or non-WPS parameters does not trigger this specific command injection, as the weakness is isolated to the processing of input within the pin2g, pin5g, and pin6g parameters.

Why is this router vulnerability a concern?

According to Halo Surface Signal, this vulnerability is significant because it resides in a web interface often accessible on edge network devices. Since these routers frequently function as internet-facing gateways, an attacker could potentially reach the vulnerable interface directly from the public internet without passing through other security layers, making it a high-priority risk for those managing these specific hardware deployments.

What should I do if I use this router?

Your first step is to locate all MSI Radix AXE6600 units within your environment and document who is responsible for managing them. Determine if these devices are configured to allow external access to their management interfaces. Once you have identified your assets and their connectivity status, monitor the official MSI support website for firmware updates and work with your infrastructure team to plan and apply the necessary patches as soon as they become available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.