External risk intelligence

MSI Radix AXE6600 Router Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71988

The affected product is an internet-facing consumer router. The vulnerability exists within core networking functionality (port forwarding) that is designed to be accessible and managed over the network, making the device a standard internet edge service.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical command injection vulnerability within MSI Radix AXE6600 router firmware, specifically in the portFw function. This flaw allows remote attackers to execute arbitrary commands and potentially gain root privileges, posing a significant risk to the integrity and security of the affected devices. The main concern is confirming relevance and exposure.

Attackers can run unauthorized commands remotely.
This is a critical flaw in network edge devices.
Verify if your network uses this router model.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by accessing the router's network interface, likely over the internet, without needing any special privileges or interaction. The vulnerability lies within the `portFw` function, which is accessed through the `alg` function. Successful exploitation could allow an attacker to execute arbitrary commands and gain root access to the device.

No authentication or user interaction needed.
Triggered through the `alg` and `portFw` functions.
Full system compromise and root privileges.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow remote attackers to execute arbitrary commands on the affected router by exploiting a flaw in the port forwarding feature. When supported by the advisory, this could lead to unauthorized access and control of the device, potentially impacting its normal operation and any connected systems.

Router system compromised.
Remote attackers exploit port forwarding.
Unauthorized command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The MSI Radix AXE6600 router firmware is susceptible to a critical command injection vulnerability. This type of issue typically falls under the purview of the infrastructure or network security teams, as it affects a core network device. The immediate practical step is to inventory all instances of this router, ascertain their network exposure, and identify business criticality. Subsequently, the accountable owner must be determined to coordinate a remediation plan based on the assessed risk.

Identify and confirm router ownership.
Verify network exposure and business criticality.
Plan and execute remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the MSI Radix AXE6600 router?

The MSI Radix AXE6600 is a high-performance tri-band gaming router designed for Wi-Fi 6E connectivity. It acts as the central gateway for home or small office networks, managing traffic and connections between local devices and the internet. Because it handles core routing functions and network traffic management, it is positioned at the network perimeter.

What is the command injection vulnerability in CVE-2026-71988?

This flaw is a type of software weakness known as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). In plain terms, the router's software fails to properly filter instructions sent to it. An attacker can use this oversight to insert their own commands into the device's operating system, effectively tricking the router into running unauthorized tasks with high-level root privileges.

How do attackers trigger this vulnerability?

An attacker triggers this by sending specially crafted inputs to the router's 'alg' (Application Layer Gateway) function, which then interacts with the flawed 'portFw' (port forwarding) component. No special user permissions or prior authentication are required to initiate this process. Simply navigating to or interacting with these specific networking functions is enough to facilitate the command execution; standard configuration settings do not negate this risk.

Is my MSI router at risk?

Halo Surface Signal notes that because this device is an internet-facing consumer router, it is considered a standard edge service. If your router is connected directly to the internet, it is exposed to remote access attempts targeting these core networking functions. You should prioritize assessing any MSI Radix AXE6600 devices currently serving as your primary network gateway.

What should I do if I run this device?

First, identify every instance of the MSI Radix AXE6600 within your network environment to understand your total footprint. Once located, determine if these routers are directly exposed to the internet. Coordinate with the individuals or teams responsible for your network hardware to monitor for official firmware updates from the manufacturer, as applying patched software is the standard path to resolve this type of core system vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.