MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn…

CVE-2026-71993 is an unauthenticated OS command injection in the OpenVPN configuration handler of the MSI Radix AXE6600 consumer Wi-Fi 6E gaming router, firmware version v781521 and earlier. Unsanitized input in the macfilter / openvpn web interface function is passed directly to a shell command, giving an attacker full root-level execution on the router's embedded Linux OS. This is one of at least eight nearly identical CWE-78 command injection CVEs (CVE-2026-71984 through CVE-2026-71993) disclosed simultaneously by researcher Jincheng Wang against the same firmware image, affecting functions like urlfilter, accesscontrol, dmz, alg, TelnetSSH, and macfilter.

The vendor CVSS of 9.8 CRITICAL is technically accurate *for the vulnerability mechanics* — it is indeed unauthenticated, network-reachable, and yields root. But for an enterprise security team, the severity is wildly overstated because the affected product has effectively zero enterprise footprint. The MSI Radix AXE6600 is a $220 consumer gaming router sold on Amazon and Walmart. It is not a managed enterprise edge appliance (Fortinet, Palo Alto, Cisco), not rack-mountable, has no centralized management, and appears in zero enterprise procurement catalogs. Unless your asset inventory specifically shows this SKU, this CVE is noise.

Why this verdict

• Installed base is consumer-only: The MSI Radix AXE6600 is a $220 Wi-Fi 6E gaming router. It is not sold through enterprise channels, has no central management platform, and does not appear in any enterprise asset management or CMDB data at scale. Probability of this SKU existing in a 10,000-host enterprise fleet is near zero.
• Role multiplier: not applicable. This is NOT an enterprise network edge appliance (Fortinet, Palo, Cisco, F5). It occupies role (a) — consumer/home-office device. Even if a remote worker uses one at home, compromising it does not grant access to the corporate network beyond what the VPN tunnel already encrypts end-to-end. Blast radius: single device + home LAN. No high-value role applies.
• Admin interface is LAN-only by default: Even for the tiny population that owns this router, the attack surface requires LAN adjacency or explicitly enabled remote management, narrowing reachable targets further.
• No exploitation evidence or PoC: EPSS is 0.0135, no KEV listing, no observed campaigns, no public exploit code. The batch of 8 similar CVEs against one firmware suggests a researcher audit, not active adversary interest.

Why not higher?

The vulnerability is technically severe (unauthenticated RCE to root), so if this were a widely-deployed enterprise edge appliance like FortiGate or PAN-OS, it would be CRITICAL with no debate. The *only* reason for the aggressive downgrade is that the affected product is a consumer gaming router with effectively zero enterprise presence. If your CMDB shows AXE6600 units, re-evaluate to HIGH.

Why not lower?

Despite negligible enterprise relevance, the flaw is real, unauthenticated, trivially exploitable, and yields root. A blanket IGNORE would be inappropriate for any organization that *does* have this hardware, and the PoC-less state could change overnight given how simple CWE-78 reproduction is in consumer routers.

1. Confirm the AXE6600 is not in your asset inventory — Run a CMDB/NAC query for MSI networking hardware or the GRAXE66 model string. If zero results, document the finding and close the ticket. This should take minutes, not days.
2. If found: disable remote management immediately — On any discovered unit, ensure the WAN-side remote management interface is disabled (it should be off by default). This eliminates the network-adjacent attack vector from the internet.
3. If found: segment the device off the enterprise network — Consumer routers should never be inline on an enterprise network. Place any discovered units behind a managed firewall or replace them with supported enterprise hardware.
4. If found: apply firmware update when MSI releases one — Monitor the MSI support portal for a patched firmware. Given the LOW noisgate severity, no mitigation SLA applies — treat as backlog hygiene.

Run this on any Linux/macOS auditor workstation with network access to your CMDB or asset management API export. No special privileges required. Example: bash check_axe6600.sh /path/to/asset_export.csv

#!/usr/bin/env bash
# noisgate CVE-2026-71993 checker
# Searches an asset inventory CSV export for MSI Radix AXE6600 devices.
# Usage: bash check_axe6600.sh <asset_csv_file>
# Exit codes: 0 = PATCHED/not present, 1 = VULNERABLE (devices found), 2 = UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <asset_csv_file>"
  echo "UNKNOWN - no asset file provided"
  exit 2
fi

ASSET_FILE="$1"

if [ ! -f "$ASSET_FILE" ]; then
  echo "UNKNOWN - file not found: $ASSET_FILE"
  exit 2
fi

# Search for MSI Radix AXE6600 or GRAXE66 model identifiers
MATCHES=$(grep -iE '(AXE6600|GRAXE66|radix.*6600|MSI.*radix)' "$ASSET_FILE" 2>/dev/null || true)

if [ -z "$MATCHES" ]; then
  echo "PATCHED - No MSI Radix AXE6600 devices found in asset inventory."
  echo "CVE-2026-71993 is not applicable to this environment."
  exit 0
else
  COUNT=$(echo "$MATCHES" | wc -l | tr -d ' ')
  echo "VULNERABLE - Found $COUNT potential MSI Radix AXE6600 device(s):"
  echo "$MATCHES"
  echo ""
  echo "Action: Verify these devices, disable remote management, and isolate from enterprise network."
  exit 1
fi

Sources

1. THREATINT CVE-2026-71993 Entry
2. TheHackerWire – CVE-2026-71993 Advisory
3. TheHackerWire – MSI Radix AXE6600 Command Injection Overview
4. OffSeq Threat Radar – CVE-2026-71993
5. MSI Official Product Page – RadiX AXE6600
6. Dong Knows Tech – MSI RadiX AXE6600 Review
7. TheHackerWire – TelnetSSH Command Injection (Related CVEs)