MSI Radix AXE6600 Router Command Injection (CVE-2026-71985)
First seen Aug 10, 2026 · Updated Aug 10, 2026 · CVSS 9.8
A critical command injection vulnerability exists in the accesscontrol function of MSI Radix AXE6600 router firmware v781521, allowing remote attackers to execute arbitrary commands with root privileges. Given the CVSS score of 9.8, exploitation likely requires no authentication and results in full device compromise, enabling attackers to intercept, redirect, or manipulate all network traffic passing through the device.
Technical Analysis
The vulnerability resides in the accesscontrol function of the router's web management interface, which fails to properly sanitize user-supplied input before passing it to a system shell, resulting in OS command injection. Successful exploitation grants attackers root-level access to the underlying Linux-based firmware, enabling arbitrary code execution, persistent implant installation, and full network traffic interception or manipulation. The CVSS 9.8 score indicates the flaw is likely remotely exploitable over the network without authentication or user interaction. Organizations running AI agent infrastructure or LLM tool-calling pipelines behind or through compromised routers of this type face elevated risk, as attackers gaining root on network edge devices can perform man-in-the-middle interception of API calls, exfiltrate credentials/API keys used by agents to reach cloud LLM providers or RAG data sources, and redirect agent network traffic to malicious endpoints.
Affected Systems
MSI Radix AXE6600 router, firmware version v781521; likely affects all devices running this firmware version with the vulnerable accesscontrol web interface exposed to LAN or WAN access
Indicators of Compromise
- No specific IOCs (hashes, IPs, domains) published at this time; monitor for anomalous outbound connections from router management interfaces and unexpected root shell processes on affected devices
Remediation Steps
- 1
Apply Firmware Update
Check MSI's official support site for a patched firmware release addressing CVE-2026-71985 and apply it immediately once available.
- 2
Restrict Management Interface Access
Disable remote/WAN access to the router's administrative and accesscontrol interfaces; limit access to trusted LAN devices only.
- 3
Network Segmentation
Isolate router management interfaces from segments hosting AI agent workloads, API gateways, or credential stores to limit blast radius if the device is compromised.
- 4
Rotate Exposed Credentials
If the device was exposed to the internet, rotate any API keys, VPN credentials, or secrets that could have been intercepted via router-level traffic manipulation.
- 5
Monitor Traffic and Logs
Deploy network monitoring to detect anomalous command execution, unauthorized configuration changes, or unusual outbound traffic from the device.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.