MSI Radix AXE6600 Router TelnetSSH Command Injection
First seen Aug 11, 2026 · Updated Aug 11, 2026 · CVSS 9.8
A critical command injection vulnerability exists in the TelnetSSH configuration function of MSI Radix AXE6600 routers running firmware v781521, allowing remote attackers to execute arbitrary commands with root privileges. Given the CVSS score of 9.8, this flaw is likely remotely exploitable without authentication, making affected devices prime targets for botnet recruitment, traffic interception, or use as network pivot points.
Technical Analysis
CVE-2026-71990 stems from improper input sanitization in the SSH configuration handler of MSI Radix AXE6600 firmware v781521, where attacker-controlled parameters passed to the TelnetSSH function are executed directly by the underlying shell. Exploitation grants root-level command execution on the router's embedded Linux OS, enabling firmware modification, persistent implants, or use of the device as a foothold for lateral movement into connected networks. The high CVSS score (9.8) indicates the vulnerability is likely exploitable remotely over the network with low complexity and no privileges required, consistent with typical SOHO/router command injection flaws (similar in nature to CVE-2023-1389 and other Mirai-class router RCEs). Organizations operating AI agents or LLM tool-use pipelines behind or through compromised routers face risk of traffic interception, DNS/API redirection, or credential and API-key theft (e.g., MITM against outbound calls to LLM providers), which could enable downstream prompt injection or data exfiltration from agent workflows.
Affected Systems
MSI Radix AXE6600 router, firmware version v781521, specifically the TelnetSSH function within the SSH configuration interface
Indicators of Compromise
- No specific IOCs published; monitor for anomalous root-shell sessions via SSH configuration endpoint, unexpected outbound connections from router management interface, and unauthorized firmware modification on MSI Radix AXE6600 devices
Remediation Steps
- 1
Apply Firmware Update
Check MSI's support portal for a patched firmware release beyond v781521 and apply it immediately.
- 2
Disable Remote SSH Management
Turn off remote/WAN-facing SSH configuration access; restrict management interface to trusted LAN only.
- 3
Network Segmentation
Isolate router management interfaces from critical infrastructure and AI agent/API-facing systems using VLANs or firewall rules.
- 4
Monitor for Exploitation
Review router logs for unauthorized SSH configuration changes, unexpected reboots, or new administrative accounts.
- 5
Change Default Credentials
Ensure strong, unique admin credentials are set and default credentials are disabled.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.