MSI Radix AXE6600 wps.cgi Command Injection Vulnerability

Technical Analysis

CVE-2026-71983 stems from insufficient input sanitization of the pin2g, pin5g, and pin6g parameters processed by the wps.cgi endpoint on MSI Radix AXE6600 routers (firmware v781521). Because these parameters are passed unsanitized into a system-level command execution context, attackers can craft payloads using shell metacharacters to inject arbitrary OS commands. Successful exploitation grants root-level access to the device, allowing attackers to install persistent backdoors, modify DNS/firewall settings, intercept or redirect traffic, and use the compromised router as a pivot point into the local network. Given the CVSS score of 9.8, exploitation likely requires no authentication and can be conducted remotely over the network interface exposing wps.cgi. For organizations running AI agents or LLM-based automation on networks behind this router, a compromised device could enable traffic interception or DNS hijacking of agent API calls (e.g., to LLM providers or RAG data sources), exposing API keys, prompts, and retrieved data to attackers, and this router-level compromise could serve as a foothold for further attacks against agent infrastructure sitting on the same network.

Affected Systems

MSI Radix AXE6600 router, firmware version v781521, specifically the wps.cgi web management interface

Indicators of Compromise

• N/A - No public IOCs disclosed at time of publication; monitor for unusual outbound connections from router management interface and unexpected requests to wps.cgi with pin2g/pin5g/pin6g parameters containing shell metacharacters (e.g., ;, |, &&, $())

Remediation Steps

1. 1

   Apply Firmware Update

   Check MSI's official support site for a patched firmware release addressing CVE-2026-71983 and apply it immediately once available.

2. 2

   Restrict Management Interface Access

   Disable remote administration and restrict access to the wps.cgi interface to trusted internal IP addresses or via VPN only.

3. 3

   Disable WPS if Unused

   If WPS functionality is not required, disable it entirely to eliminate the vulnerable attack surface.

4. 4

   Network Segmentation

   Place routers and IoT/network devices on isolated VLANs separate from critical infrastructure, including any hosts running AI agent or LLM pipeline components, to limit lateral movement.

5. 5

   Monitor and Log Traffic

   Enable logging on the router (if supported externally via syslog) and monitor for anomalous requests to CGI endpoints or unexpected outbound traffic indicating compromise.

6. 6

   Rotate Exposed Credentials

   If the router has been exposed to the internet, rotate any credentials or API keys that may traverse the network, including those used by AI agents or automation tools.