Executive Summary
A critical command injection vulnerability (CVE-2026-71985) has been identified in the MSI Radix AXE6600 Wi-Fi 6E router affecting firmware version v781521. The vulnerability is present in the accesscontrol function — the subsystem responsible for managing network access rules and device restrictions. Exploiting this flaw allows remote attackers to inject and execute arbitrary OS commands with root privileges, effectively granting full control of the network device.
CVSS Score: 9.8 (Critical)
This is the third in a cluster of four simultaneously disclosed critical command injection vulnerabilities in the MSI Radix AXE6600 firmware.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-71985 |
| CVSS Score | 9.8 (Critical) |
| Type | Command Injection |
| Affected Component | accesscontrol — network access control management |
| Attack Vector | Network |
| Authentication | None required |
| Privileges Required | None |
| User Interaction | None |
| Impact | Root command execution |
Root Cause
The accesscontrol function in MSI Radix AXE6600 firmware v781521 handles network access restriction rules — such as MAC address filtering, device blocking, and time-based access policies. User-supplied input passed to this function is not properly sanitized before being incorporated into shell commands, enabling OS command injection.
This is a textbook case of CWE-78 (Improper Neutralization of Special Elements used in an OS Command) — a well-known vulnerability class that should be caught during firmware security review.
Affected Versions
| Product | Firmware Version | Status |
|---|---|---|
| MSI Radix AXE6600 | v781521 | Vulnerable |
Technical Details
The Irony of Access Control Vulnerabilities
The accesscontrol function is specifically designed to restrict who can communicate through the router. A command injection vulnerability in this subsystem is particularly ironic: an attacker can use the very mechanism meant to enforce network restrictions to bypass all security controls and gain unrestricted root access to the device.
Attack Flow
1. Attacker sends crafted HTTP request to the accesscontrol endpoint
2. Malicious input (e.g., a device MAC or policy name) contains shell metacharacters
3. Firmware passes unsanitized input to shell command (e.g., via system() or popen())
4. Shell interprets the injected commands and executes them as root
5. Attacker achieves persistent, privileged access to the routerBroader Systemic Issue
The simultaneous disclosure of four CVEs (71983–71986) in the same firmware version across different subsystems indicates this is not an isolated coding error — it reflects a systemic lack of input validation throughout the MSI Radix AXE6600 firmware codebase. All four affected functions (wps.cgi, urlfilter, accesscontrol, dmz) share the same fundamental weakness.
Impact
Successful exploitation allows an attacker to:
- Gain root shell access to the router
- Completely bypass access control rules — the very feature the vulnerability resides in
- Intercept network traffic from all connected devices
- Redirect DNS queries for phishing and credential harvesting
- Persist on the device across reboots via firmware or scheduled job modification
- Enumerate and attack internal LAN devices using the router as a pivot
- Disable security logging and monitoring
Remediation
Priority Actions
- Update firmware immediately when MSI releases a patched version
- Disable access control / MAC filtering features temporarily to reduce attack surface until patched
- Block WAN-side admin access — ensure the router management interface is not reachable from the internet
- Review current access control rules for any unauthorized changes
- Monitor connected devices for unexpected additions or modifications
Hardening Guidance
| Action | Benefit |
|---|---|
| Disable remote management | Eliminates WAN attack surface |
| Restrict admin access to specific LAN IPs | Limits LAN exposure |
| Disable unused features (WPS, DMZ, URL filtering) | Reduces attack surface across all 4 CVEs |
| Enable router syslog to external server | Preserves audit trail even if router is compromised |
| Use upstream firewall/UTM appliance | Provides defense-in-depth |
Detection
| Indicator | Description |
|---|---|
| Unexpected access control rule changes | MAC blacklists/whitelists modified without user action |
| New device entries in access control list | Attacker may whitelist their own device |
| Admin interface accessible from WAN | Configuration exposure |
| Unusual DNS or routing changes | Post-compromise persistence indicators |
Related CVEs
All four CVEs were disclosed simultaneously for MSI Radix AXE6600 firmware v781521:
| CVE | Affected Function | CVSS |
|---|---|---|
| CVE-2026-71983 | wps.cgi (pin2g/pin5g/pin6g) | 9.8 |
| CVE-2026-71984 | urlfilter | 9.8 |
| CVE-2026-71985 (this advisory) | accesscontrol | 9.8 |
| CVE-2026-71986 | dmz | 9.8 |
Key Takeaways
- CVSS 9.8 Critical — Unauthenticated remote command injection achieving root access
- Access control subsystem is the vector — attackers can exploit the feature designed to prevent unauthorized access
- Systemic issue — four CVEs in one firmware indicates codebase-wide input validation failures
- Mitigation: Restrict admin interface access, disable unused features, patch immediately when available
- Home and SMB users running this router should treat it as a critical priority remediation