External risk intelligence

MSI Radix AXE6600 Command Injection via DMZ Function

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71986

The vulnerability exists in a router, a device designed to be positioned at the internet edge. The affected DMZ (demilitarized zone) function is a standard feature on consumer routers intended to expose internal network services directly to the public internet, making the vulnerable management or configuration surface inherently public-facing by design.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects MSI Radix AXE6600 router firmware, allowing remote attackers to execute arbitrary commands and gain root privileges. The issue lies within the DMZ function, which, by design, can be exposed to the internet. Understanding the potential impact on network security is essential for leadership.

Unauthenticated remote command execution in router DMZ.
This impacts network security and device control.
Confirm relevance and potential exposure to your network.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by targeting the router's demilitarized zone (DMZ) function over the network. No special access is needed, as this function is exposed externally. Once the attacker interacts with the DMZ feature, they can inject commands that the router will execute, potentially leading to full system compromise.

Accessible via the network.
Triggered through the DMZ function.
Allows remote command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in MSI router firmware could allow remote attackers to execute arbitrary commands by exploiting the DMZ function. When supported by the advisory, this could lead to unauthorized access and control over the affected device.

Router system commands at risk.
Via the DMZ function remotely.
Root privilege access could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The MSI Radix AXE6600 router's firmware contains a critical command injection vulnerability. This issue is likely to impact network or security teams responsible for edge devices and vendor-managed infrastructure. The first practical step is to identify all instances of this router, confirm their internet exposure and business criticality, and then determine the accountable owner before planning remediation.

Network/security teams likely own this.
Verify internet-facing and business-critical devices.
Coordinate with the vendor for firmware updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the MSI Radix AXE6600?

The MSI Radix AXE6600 is a Wi-Fi 6E tri-band gaming router. It acts as a central hub for home or small office networking, managing internet traffic distribution and providing wireless connectivity for connected devices. Like other modern routers, it includes administrative firmware features, such as a DMZ (demilitarized zone) function, which allows users to direct internet traffic to a specific internal device.

What does command injection mean for CVE-2026-71986?

This vulnerability is classified as CWE-78, which refers to OS Command Injection. It occurs when a system unintentionally executes untrusted commands provided by an attacker. In this specific case, the router fails to properly sanitize inputs within its DMZ configuration function, allowing an unauthorized user to inject and run their own system-level commands with root privileges, effectively taking full control of the device.

How is this vulnerability triggered?

An attacker triggers this flaw by interacting with the router's DMZ function over the network. Because the vulnerability is specific to the handling of inputs within this feature, it is not triggered by standard web browsing or routine use of the router's Wi-Fi. The flaw requires the attacker to actively send specially crafted requests to the DMZ interface to execute malicious commands.

Is my network at risk from this CVE?

Halo Surface Signal indicates this vulnerability is highly relevant because the affected device is a router, which naturally sits at your network's internet edge. Since the DMZ function is intended to expose internal services to the public internet, the vulnerable surface is often already exposed by design. If you use the DMZ feature on an MSI Radix AXE6600, your device is effectively reachable from the internet, increasing the potential for unauthorized access.

What should I do if I run this router?

Your first step is to create an inventory of all MSI Radix AXE6600 devices in your environment to assess their usage. Check your router settings to see if the DMZ function is currently enabled. Since this is a firmware-level issue, you should monitor the official MSI support website for firmware updates and coordinate with your internal IT or security team to apply the latest patches as soon as they become available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.