MSI Radix AXE6600 Critical Command Injection in Access Control Function (CVE-2026-71985)

Executive Summary

A critical command injection vulnerability (CVE-2026-71985) has been identified in the MSI Radix AXE6600 Wi-Fi 6E router affecting firmware version v781521. The vulnerability is present in the accesscontrol function — the subsystem responsible for managing network access rules and device restrictions. Exploiting this flaw allows remote attackers to inject and execute arbitrary OS commands with root privileges, effectively granting full control of the network device.

CVSS Score: 9.8 (Critical)

This is the third in a cluster of four simultaneously disclosed critical command injection vulnerabilities in the MSI Radix AXE6600 firmware.

Vulnerability Overview

Root Cause

The accesscontrol function in MSI Radix AXE6600 firmware v781521 handles network access restriction rules — such as MAC address filtering, device blocking, and time-based access policies. User-supplied input passed to this function is not properly sanitized before being incorporated into shell commands, enabling OS command injection.

This is a textbook case of CWE-78 (Improper Neutralization of Special Elements used in an OS Command) — a well-known vulnerability class that should be caught during firmware security review.

Affected Versions

Technical Details

The Irony of Access Control Vulnerabilities

The accesscontrol function is specifically designed to restrict who can communicate through the router. A command injection vulnerability in this subsystem is particularly ironic: an attacker can use the very mechanism meant to enforce network restrictions to bypass all security controls and gain unrestricted root access to the device.

Attack Flow

1. Attacker sends crafted HTTP request to the accesscontrol endpoint
2. Malicious input (e.g., a device MAC or policy name) contains shell metacharacters
3. Firmware passes unsanitized input to shell command (e.g., via system() or popen())
4. Shell interprets the injected commands and executes them as root
5. Attacker achieves persistent, privileged access to the router

Broader Systemic Issue

The simultaneous disclosure of four CVEs (71983–71986) in the same firmware version across different subsystems indicates this is not an isolated coding error — it reflects a systemic lack of input validation throughout the MSI Radix AXE6600 firmware codebase. All four affected functions (wps.cgi, urlfilter, accesscontrol, dmz) share the same fundamental weakness.

Impact

Successful exploitation allows an attacker to:

• Gain root shell access to the router
• Completely bypass access control rules — the very feature the vulnerability resides in
• Intercept network traffic from all connected devices
• Redirect DNS queries for phishing and credential harvesting
• Persist on the device across reboots via firmware or scheduled job modification
• Enumerate and attack internal LAN devices using the router as a pivot
• Disable security logging and monitoring

Remediation

Priority Actions

1. Update firmware immediately when MSI releases a patched version
2. Disable access control / MAC filtering features temporarily to reduce attack surface until patched
3. Block WAN-side admin access — ensure the router management interface is not reachable from the internet
4. Review current access control rules for any unauthorized changes
5. Monitor connected devices for unexpected additions or modifications

Hardening Guidance

Detection

Related CVEs

All four CVEs were disclosed simultaneously for MSI Radix AXE6600 firmware v781521:

Key Takeaways

1. CVSS 9.8 Critical — Unauthenticated remote command injection achieving root access
2. Access control subsystem is the vector — attackers can exploit the feature designed to prevent unauthorized access
3. Systemic issue — four CVEs in one firmware indicates codebase-wide input validation failures
4. Mitigation: Restrict admin interface access, disable unused features, patch immediately when available
5. Home and SMB users running this router should treat it as a critical priority remediation

References

• NVD — CVE-2026-71985
• MSI Product Support

Related Advisories

• MSI Radix AXE6600 WPS Command Injection (CVE-2026-71983)
• MSI Radix AXE6600 URL Filter Command Injection (CVE-2026-71984)
• MSI Radix AXE6600 DMZ Command Injection (CVE-2026-71986)