External risk intelligence

MSI Radix AXE6600 Router Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71987

The vulnerability affects a consumer router, which is an internet-facing edge device by design. Routers often expose services to the internet to facilitate network management and connectivity, making this component highly likely to be reachable from the public internet.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a command injection vulnerability in MSI Radix AXE6600 router firmware, which could allow remote attackers to execute arbitrary commands and gain root privileges. The concern is to understand the relevance and potential exposure of this technology.

Flaw lets attackers run commands remotely.
Confirm if this router model is in use.
Assess business risk and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target an MSI Radix AXE6600 router accessible over the network. By sending specially crafted data to the `alg` function, they could trick the router into executing arbitrary commands. This could ultimately allow the attacker to gain full control of the device, including root privileges.

Network access is sufficient.
Triggered via the `alg` function.
Risk of arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

A command injection vulnerability in the alg function of MSI Radix AXE6600 router firmware could allow remote attackers to execute arbitrary commands on the device. When supported by the advisory, this could lead to attackers obtaining root privileges on the underlying system.

System access and control.
Remote code execution via alg function.
Potential root privilege escalation.

Operational Fix

Recommended remediation, mitigation, and detection steps

The responsible teams for this critical command injection vulnerability in MSI Radix AXE6600 router firmware are likely to include infrastructure, network/security, and potentially vendor management teams. The first practical move is to identify all instances of this router, assess their exposure and business criticality, and then coordinate with the vendor for remediation or implement temporary risk reduction measures.

Infrastructure and security teams own resolution.
Verify router reachability and business impact.
Plan vendor-coordinated remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the MSI Radix AXE6600?

The MSI Radix AXE6600 is a high-performance tri-band Wi-Fi 6E gaming router. It acts as a central hub for home or small office networks, managing internet traffic, providing wireless connectivity for devices, and offering specialized features to optimize gaming latency and connection stability.

What does command injection mean for CVE-2026-71987?

This vulnerability is classified as CWE-78, or OS Command Injection. It means the router's software fails to properly filter input before passing it to the underlying operating system. Because of this, an attacker can send specific instructions that the router mistakes for legitimate system commands, allowing unauthorized code execution.

How does an attacker trigger this vulnerability?

The flaw is triggered by sending specially crafted data specifically to the router's 'alg' function. Simply browsing the web or using standard Wi-Fi features does not inherently trigger this issue; the attacker must intentionally target this specific function with malicious input to achieve unauthorized control.

Is my MSI Radix AXE6600 at risk?

If you are using this router, it is considered potentially at risk. Halo Surface Signal notes that because the MSI Radix AXE6600 is an edge device designed to connect local networks to the internet, its management services are often reachable from the public internet, which increases the likelihood of unauthorized network access.

What should I do to secure my router?

Begin by identifying all MSI Radix AXE6600 units in your environment and checking their firmware version. Contact MSI or monitor their official support site for available firmware updates. Until a fix is applied, evaluate if you can restrict management access to the router to trusted local devices only.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.