11 MSI RadiX AXE6600 Flaws Allow Root Command Injection

Eleven critical command-injection vulnerabilities have been disclosed in the MSI RadiX AXE6600 router. The flaws, tracked as CVE-2026-71983 through CVE-2026-71993, affect firmware v781521 and can let a network attacker run commands with root privileges. VulnCheck lists v782418 as the fixed version, so owners should update rather than rely on a password change alone.

No active exploitation campaign has been reported. The practical risk depends on whether an attacker can reach the router’s management functions—from the internet through exposed administration, from an untrusted local network, or from an already-compromised device inside the LAN.

Who Is Affected

The disclosure names the RadiX AXE6600 WiFi 6E Tri-Band Gaming Router, model GRAXE66. Do not confuse it with the separate RadiX AX6600 model: similar product names are not evidence that another router is affected by this exact CVE group.

What the Eleven CVEs Cover

GitHub’s reviewed advisories assign each issue a critical CVSS 3.1 score of 9.8: network-accessible, low complexity, no privileges, and no user interaction. The affected handlers cover features that owners may recognize from the router administration interface.

The common failure is unsafe input reaching operating-system commands. Successful exploitation can therefore cross the boundary from changing a router setting to executing attacker-controlled commands as root.

What AXE6600 Owners Should Do

1. Confirm the exact model and firmware. Photograph the label and record the current version before changing anything. The affected model is AXE6600/GRAXE66, not every MSI router.
2. Download firmware from MSI support. Use the official RadiX AXE6600 support page and verify that the installed release is v782418 or later. MSI’s normal path is Advanced → Administration → Firmware Upgrade. Do not interrupt power during the update.
3. Reduce management exposure. Disable administration from the WAN, WPS, Telnet, SSH, UPnP, and other services you do not need. These controls reduce reachability but do not replace the firmware fix.
4. Review high-value settings. Check DNS resolvers, port-forwarding and port-trigger rules, DMZ hosts, VPN profiles, MAC filters, access-control rules, and unknown administrator accounts.
5. Reset after the update if exposure is plausible. If WAN administration was enabled, settings changed unexpectedly, or an untrusted device had LAN access, factory-reset the patched router and configure it manually. Avoid restoring a backup created after the suspected exposure.
6. Change credentials from a clean device. Replace the router administrator password and Wi-Fi passphrase. If you saw redirects, certificate warnings, or fake login pages, change important account passwords from a different trusted network.

A factory reset on vulnerable firmware is not a fix because it restores settings without removing the affected code. Updating first changes the firmware; resetting afterward helps remove attacker-created configuration. Our broader router compromise checklist explains how to investigate suspicious DNS, remote management, and forwarding changes.

How This Differs From Other Router Backdoors

This MSI case has a fixed firmware release. That makes it different from the ENDLESSDOORS firmware implant, where replacement was the safer decision because no trusted fixed image was available. It also differs from the Tenda hidden authentication path: the AXE6600 disclosure is a group of input-handling flaws across eleven administration functions.

Do not assume every connected PC is infected merely because the router was vulnerable. Scan endpoints when there are separate signs—unexpected downloads, recurring redirects, new startup items, security alerts, or settings that return after the router is patched and reset.

References

1. VulnCheck. “MSI RadiX AXE6600 v781521 Command Injection via accesscontrol Function.” VulnCheck Advisories, published August 8, 2026, accessed August 9, 2026. https://www.vulncheck.com/advisories/msi-radix-axe6600-v781521-command-injection-via-accesscontrol-function
2. GitHub. “MSI RadiX AXE6600 router firmware v781521 command injection in wps.cgi.” GitHub Security Advisory GHSA-wj6p-gv6v-932v, published August 9, 2026, accessed August 9, 2026. https://github.com/advisories/GHSA-wj6p-gv6v-932v