CVE-2026-71983

Received Received - Intake

Command Injection in MSI Radix AXE6600 Router Firmware

Publication date: 2026-08-08

Last updated on: 2026-08-08

Assigner: VulnCheck

Description

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the wps.cgi interface that allows remote attackers to execute arbitrary commands by injecting malicious input through the pin2g, pin5g, or pin6g parameters. Attackers can exploit these unsanitized parameters to execute arbitrary commands on the affected device and obtain root privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-08

Last Modified

2026-08-08

Generated

2026-08-09

AI Q&A

2026-08-09

EPSS Evaluated

N/A

NVD

CVE-2026-71983

EUVD

EUVD-2026-54826

Affected Vendors & Products

Vendor	Product	Version / Range
msi	radix_axe6600	781521

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a command injection flaw in the MSI Radix AXE6600 router firmware version v781521. It exists in the wps.cgi interface where unsanitized parameters pin2g, pin5g, or pin6g can be exploited by remote attackers to inject malicious commands. Successful exploitation allows attackers to execute arbitrary commands on the device and gain root privileges.

Detection Guidance

To detect this vulnerability, scan for exposed MSI Radix AXE6600 routers with firmware v781521. Check if the wps.cgi interface is accessible and test the pin2g, pin5g, or pin6g parameters for command injection by sending crafted inputs and observing responses.

Impact Analysis

If you own or use an MSI Radix AXE6600 router with firmware version v781521, attackers could remotely take control of your device. This could lead to unauthorized access, data theft, network compromise, or the device being used as part of a botnet. Your internet traffic and connected devices may also be exposed.

Compliance Impact

This vulnerability allows remote attackers to execute arbitrary commands with root privileges on the MSI Radix AXE6600 router. Such unauthorized access could lead to data breaches, unauthorized data access, or manipulation, which may violate compliance requirements under GDPR (e.g., unauthorized data processing) and HIPAA (e.g., unauthorized access to protected health information).

Mitigation Strategies

Immediately update the router firmware to the latest patched version. If no patch is available, disable remote access to the wps.cgi interface or block external access to the router's web interface. Monitor network traffic for suspicious activity targeting these parameters.

Hi! I’m here to help you understand CVE-2026-71983. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70