CVE-2026-71990

MSI Radix AXE6600 v781521 Command Injection via TelnetSSH Function

State: Published
Severity: 9.3 Critical
Published: Aug 8, 2026
Updated: Sep 24, 2026
Reserved: Aug 8, 2026

Description

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for SSH configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the SSH configuration interface to inject malicious commands and obtain root privileges on the underlying system.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
Radix AXE6600MSI	v781521 and earlierAffected

References

MSI Vendor Siteproduct
Fix Version Downloadpatch
https://www.vulncheck.com/advisories/msi-radix-axe6600-v781521-command-injection-via-telnetssh-functionthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.