MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the alg…

CVE-2026-71987 is a classic OS command injection (CWE-78) in the alg (Application Layer Gateway) configuration function of the MSI Radix AXE6600 router's web management interface, firmware version v781521. Successful exploitation yields root-level command execution on the router's embedded Linux OS. The bug is one of at least eight sibling CVEs (CVE-2026-71984 through CVE-2026-71992) disclosed simultaneously by researcher Jincheng Wang, hitting nearly every admin function — macfilter, dmz, accesscontrol, portFw, TelnetSSH, urlfilter, and alg. All share the same root cause: unsanitized user input passed directly to a shell. Only firmware v781521 is confirmed affected.

The vendor CVSS of 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) wildly overstates the risk for any enterprise security team. This is a consumer Wi-Fi 6E gaming router sold at Newegg and Amazon for ~$200. It has no enterprise management plane, no centralized deployment tooling, no presence in any enterprise procurement catalog, and its admin panel defaults to LAN-side access only. The 9.8 treats the LAN-bound web UI as equivalent to an internet-facing attack surface — it is not. For the audience this advisory serves (defenders managing 10,000+ hosts), this CVE is noise.

Why this verdict

• Enterprise footprint: zero. The MSI Radix AXE6600 is a $200 consumer gaming router sold through Amazon and Newegg. It does not appear in any enterprise networking vendor catalog. An enterprise managing 10,000 hosts has effectively 0% probability of this device in their managed inventory.
• LAN-only admin panel. The CVSS vector claims AV:N (network), but the management interface is bound to the LAN by default. Remote management is off. The realistic attack vector is AV:A (adjacent network), which alone drops the CVSS to ~8.8 — and that still overstates it because 'adjacent' means sitting on someone's home Wi-Fi.
• No PoC, no exploitation, low EPSS. At 1.35% EPSS with no public exploit code and no observed campaigns, weaponization risk in the near term is minimal.
• Role multiplier: This router is NOT a network edge appliance in the enterprise sense. It is not an F5, Palo Alto, FortiGate, or Cisco ASA. (a) *Low-value role:* home user's internet gateway — this is the canonical deployment. Blast radius = 1 household. (b) *Typical role:* does not exist in enterprise. (c) *High-value role:* not applicable — this device is never deployed as a perimeter firewall, DC gateway, or branch office router in managed environments. The high-value role floor does NOT apply because <0.1% of the installed base occupies any enterprise-relevant role.

Why not higher?

To justify MEDIUM or above, the device would need measurable enterprise deployment or internet-facing exposure. Neither exists. The CVSS 9.8 is technically valid *on the device itself*, but severity for an enterprise patching queue must account for whether the device is in the fleet. It is not. Even for organizations with BYOD/remote-worker routers, the enterprise does not manage consumer router firmware.

Why not lower?

The underlying vulnerability is real and trivially exploitable once the admin panel is reachable — unauthenticated command injection yielding root. If an organization somehow deploys this router (e.g., a lab, a demo environment, a founder's home office on the corporate VPN), the impact on that node is total compromise. That prevents an IGNORE rating.

1. Confirm the device is not in your asset inventory — Search your CMDB and network scans for MSI OUI (00:D9:D1, 80:CE:62) and HTTP server banners matching the Radix AXE6600. If absent, close this CVE as not-applicable. No mitigation SLA applies for a LOW verdict — treat as backlog hygiene.
2. If found: disable remote management — On any discovered unit, ensure the remote management toggle is OFF (this is the default). This confines the attack surface to the LAN segment.
3. If found: segment the device — Place the router on an isolated VLAN with no route to production subnets. Monitor for unusual outbound connections from the device's MAC.

Run this on any Linux/macOS auditor workstation that can reach your network scanner's export or your CMDB API. It checks for MSI OUI prefixes in an ARP table or nmap scan output. No special privileges needed beyond read access to the ARP table. Example: bash check_msi_router.sh /path/to/nmap-scan.xml or just bash check_msi_router.sh to check the local ARP cache.

#!/usr/bin/env bash
# check_msi_router.sh — Detect MSI Radix AXE6600 on the network
# Usage: bash check_msi_router.sh [nmap-xml-file]
# Exit codes: 1=VULNERABLE (device found), 0=PATCHED (not found), 2=UNKNOWN

MSI_OUIS="00:d9:d1|80:ce:62|00:D9:D1|80:CE:62"

if [ -n "$1" ] && [ -f "$1" ]; then
  echo "[*] Scanning nmap XML export: $1"
  if grep -iqE "(radix|axe6600|msi)" "$1" || grep -iE "$MSI_OUIS" "$1" > /dev/null 2>&1; then
    echo "VULNERABLE — MSI device signature found in scan data. Investigate manually."
    exit 1
  else
    echo "PATCHED — No MSI Radix AXE6600 signatures found in scan data."
    exit 0
  fi
else
  echo "[*] Checking local ARP cache for MSI OUI prefixes..."
  ARP_OUT=$(arp -a 2>/dev/null || ip neigh 2>/dev/null)
  if echo "$ARP_OUT" | grep -iE "$MSI_OUIS" > /dev/null 2>&1; then
    echo "VULNERABLE — MSI OUI detected in ARP cache. Confirm device model manually."
    exit 1
  else
    echo "PATCHED — No MSI OUI found in local ARP cache."
    echo "Note: This only checks the local subnet. For full coverage, supply an nmap XML scan."
    exit 0
  fi
fi

Sources

1. THREATINT CVE-2026-71987 Detail
2. OffSeq Threat Radar — Related MSI Radix CVEs
3. Tom's Hardware — MSI RadiX AXE6600 Review
4. MSI US Official Store — Radix AXE6600
5. CISA KEV Catalog
6. Newegg — MSI Radix AXE6600 Product Page
7. HighSpeedInternet — MSI Radix AXE6600 Review