External risk intelligence

MSI Radix AXE6600 Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71984

The vulnerability exists in a consumer wireless router's management functionality. Routers are designed as internet edge gateways, and vulnerabilities in features like URL filtering are often reachable via the device's administrative interface or WAN-side services, making them public-facing by design in normal deployment.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical command injection vulnerability discovered in MSI Radix AXE6600 router firmware. The flaw allows remote attackers to execute arbitrary commands, potentially gaining root privileges on the affected device. This type of vulnerability in a network edge device warrants careful consideration.

Attackers can run commands on the router.
It affects network edge devices controlling internet access.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable function by sending specially crafted network requests to the router. This would allow them to inject commands through the urlfilter feature, potentially gaining full control of the device.

No specific access needed.
Triggered via the urlfilter function.
Risk of arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow remote attackers to execute arbitrary commands on the affected router, potentially gaining root privileges and full control over the device when its urlfilter function is exploited.

Router system commands could be affected.
Attackers could inject malicious commands remotely.
Complete system compromise is a realistic consequence.

Operational Fix

Recommended remediation, mitigation, and detection steps

The primary responsibility for addressing this command injection vulnerability in MSI Radix AXE6600 router firmware typically falls to the infrastructure or platform team that manages network devices. The first critical step is to conduct an inventory to identify all instances of the affected router model, ascertain their network exposure, and pinpoint the accountable owner for each device before planning any remediation.

Infrastructure or platform teams own this issue.
Verify device exposure and identify accountable owners.
Plan remediation based on risk and business impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the MSI Radix AXE6600?

The MSI Radix AXE6600 is a high-performance WiFi 6E tri-band gaming router. These devices serve as network edge gateways, managing internet traffic, security policies, and local device connectivity for home or small office environments. The affected firmware, version v781521, contains the specific management features now under scrutiny.

What does command injection mean for CVE-2026-71984?

This vulnerability falls under the CWE-78 weakness class, which involves improper neutralization of special elements used in an OS command. In plain terms, it means the router's software incorrectly processes user-supplied input, allowing an attacker to insert and execute their own unauthorized system-level commands, potentially granting them root (administrator) privileges.

How is this vulnerability triggered?

The bug is triggered when an attacker sends specifically crafted network requests to the device's urlfilter function. It is important to note that this flaw does not require the attacker to have prior authentication or special access to the device; however, the vulnerability is tied specifically to the URL filtering mechanism. Normal router operations that do not involve interacting with this specific filter are not the source of this injection.

Is my device at risk based on Halo Surface Signal?

Yes, if you use this router as an internet edge gateway, you should consider it high risk. Halo Surface Signal identifies this as an external vulnerability because the affected management functionality is often reachable via WAN-side services or the administrative interface. Since these routers are designed to be public-facing by nature, they are inherently exposed to remote reachability.

What should I do to address this CVE?

Begin by auditing your network infrastructure to locate all active MSI Radix AXE6600 devices. Once identified, determine the network exposure of each unit and establish which team or individual is responsible for its maintenance. Finally, monitor official MSI support channels for firmware updates that address this command injection flaw and prepare to apply them as soon as they become available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.