Radix AXE6600 (V781521) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/radix-axe6600-v781521/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 08 Aug 2026 23:42:11 +0000Command Injection in MSI Radix AXE6600 Routerhttps://feed.craftedsignal.io/briefs/2026-08-msi-router-command-injection/Sat, 08 Aug 2026 23:42:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-msi-router-command-injection/The MSI Radix AXE6600 router firmware version v781521 is vulnerable to remote command injection via the wps.cgi interface, allowing unauthenticated attackers to execute arbitrary commands with root privileges.The MSI Radix AXE6600 router running firmware version v781521 contains a critical command injection vulnerability in its web-based management interface. The vulnerability exists within the wps.cgi file, which fails to properly sanitize user-supplied input provided via the pin2g, pin5g, or pin6g parameters. An unauthenticated remote attacker can supply malicious payloads to these parameters to execute arbitrary commands on the underlying operating system. Because the web service operates with high privileges, successful exploitation results in full root access to the device. This poses a significant risk to the integrity and confidentiality of the network, as the compromised router can be used to facilitate man-in-the-middle attacks, exfiltration, or further lateral movement into the internal network. Defenders should monitor for anomalous HTTP requests targeting this specific CGI endpoint.

Impact

Successful exploitation of CVE-2026-71983 allows an attacker to achieve unauthenticated remote code execution with root-level privileges on the target router. This provides full control over the gateway device, enabling the attacker to intercept or modify all traffic traversing the device, pivot into the local area network, or persist across reboots.

Recommendation

  • Immediately update the firmware of all MSI Radix AXE6600 routers to the latest available version provided by the manufacturer to remediate CVE-2026-71983.
  • Restrict access to the router web management interface (port 80/443) so that it is only accessible from trusted administrative IP addresses rather than the internet.
  • Monitor perimeter firewall and proxy logs for HTTP GET or POST requests directed at /wps.cgi that contain suspicious characters (such as semicolons, pipes, or backticks) within the pin2g, pin5g, or pin6g parameters.
]]>criticaladvisory