CVE-2026-71983
MSI Radix AXE6600 v781521 Command Injection via wps.cgi
- State
- Published
- Severity
- 9.3 Critical
- Published
- Aug 8, 2026
- Updated
- Sep 24, 2026
- Reserved
- Aug 8, 2026
Description
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the wps.cgi interface that allows remote attackers to execute arbitrary commands by injecting malicious input through the pin2g, pin5g, or pin6g parameters. Attackers can exploit these unsanitized parameters to execute arbitrary commands on the affected device and obtain root privileges.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
Radix AXE6600MSI |
|
References
- MSI Vendor Siteproduct
- Fix Version Downloadpatch
- https://www.vulncheck.com/advisories/msi-radix-axe6600-v781521-command-injection-via-wps-cgithird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.