External risk intelligence

MSI Radix AXE6600 Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71989

The vulnerability affects a consumer-grade router, which is an internet edge device. By design, such devices act as gateways between the public internet and private networks, and management or trigger functions are often exposed or reachable, making them public-facing by design in normal deployment.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in MSI Radix AXE6600 router firmware that could allow attackers to execute arbitrary commands on the device, potentially gaining control of the system. This issue is particularly concerning as it affects an internet edge device, which is inherently exposed to external threats.

Remote attackers can run their own commands.
This impacts internet-facing home and business devices.
Confirm relevance and exposure on affected devices.

Attack Path

How an attacker could exploit the issue

An attacker can exploit a command injection vulnerability in the MSI Radix AXE6600 router's firmware by sending specially crafted input to the `alg` function, which is called by `porTrigger`. This allows them to execute arbitrary commands on the device, potentially gaining root privileges.

Entry condition: Unauthenticated network access.
Trigger point: Interaction with the `alg` function.
Resulting risk: Arbitrary command execution and root access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary commands on the router when the `alg` function is reachable. This could potentially lead to the compromise of the device's underlying system and grant the attacker root privileges.

Router system compromised.
Remote command execution possible.
Attain root access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects MSI Radix AXE6600 routers, likely managed by home users or small businesses. Initial steps should focus on identifying all deployed units, assessing their internet exposure and business criticality, and locating the responsible owner for remediation planning.

Home users/small businesses own the issue.
Verify internet-facing devices and impact.
Plan coordinated firmware updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the MSI Radix AXE6600 router?

The MSI Radix AXE6600 is a tri-band Wi-Fi 6E gaming router. It acts as a central networking hub, managing traffic between the internet and home or small office devices. Because it handles routing, firewall, and connection settings, it serves as the primary gateway device for the local network.

What does command injection mean for CVE-2026-71989?

This vulnerability falls under the CWE-78 weakness class, which involves improper neutralization of special elements used in an OS command. In the context of this CVE, it means the router's software fails to safely process input, allowing an attacker to insert their own system commands. If successful, the device executes these unintended commands with root-level privileges, effectively giving an attacker full control over the router's operating system.

How do attackers trigger this vulnerability?

An attacker triggers this by sending specifically formatted network traffic to the device's 'alg' function, which is utilized by the 'porTrigger' feature. The flaw is not triggered by normal router usage or standard web browsing; it requires a targeted attempt to interact with these specific internal software functions. Without this direct interaction with the vulnerable code path, the command injection does not occur.

Is my device vulnerable to this CVE?

Halo Surface Signal notes that since this is a consumer-grade router designed to sit at the edge of your network, it is inherently internet-facing. If you have an affected MSI Radix AXE6600, the device is likely reachable from the public internet by design. This accessibility makes it important to verify if your specific unit is using the affected firmware version, as these devices are positioned at the critical boundary between your private network and the outside world.

How should I respond to CVE-2026-71989?

Begin by identifying all MSI Radix AXE6600 units currently in your environment. Once identified, prioritize checking for any official firmware updates provided by MSI, as applying the latest patches is the standard way to resolve such software-level vulnerabilities. Ensure you verify the device's connection status and plan for a maintenance window to apply necessary updates without disrupting your network services.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.