Back Feedly

CVE-2026-71992 - Exploits & Severity

Feedly • August 9, 2026

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the macfilter function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject malicious commands and obtain root privileges on the underlying system.

An unauthenticated attacker over the network can inject arbitrary commands through the macfilter function to execute code with root privileges on the affected router.

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch available. See Github Advisory:

Apply the available patch immediately. Additionally, restrict network access to the router's management interface, use network segmentation to limit exposure, and monitor for suspicious command injection attempts in router logs.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD published the first details for CVE-2026-71992

A CVSS base score of 9.8 has been assigned.

Feedly found the first article mentioning CVE-2026-71992 . See article

GitHub Advisories released a security advisory .

Critical Command Injection Vulnerabilities in MSI Radix AXE6600 Router Firmware

CVE Daily Brief — 2026-08-09

MSI Radix AXE6600 routers (v781521) affected by CRITICAL OS command injection (CVE-2026-71992, CVSS 9.3). Remote attackers can execute root commands — no auth needed. Restrict access, monitor logs. No patch yet. #OffSeq #CVE202671992 #RouterSecurity

CVE-2026-71992 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the macfilter function that allows remote attackers to execute arbitra…

Collect, analyze, and vulnerability reports faster using AI

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Command Injection Vulnerabilities in MSI Radix AXE6600 Router Firmware MSI Radix AXE6600 router firmware version v781521 has multiple command injection vulnerabilities, identified as CVE-2026-71993, CVE-2026-71992, and CVE-2026-71987. These flaws allow unauthenticated remote attackers to execute arbitrary commands with root privileges by exploiting the openvpn, macfilter, and alg functions. The vulnerabilities have been assigned high CVSS scores of 9.8 and 9.3, indicating severe risks to confidentiality, integrity, and availability. Currently, no public proof-of-concept exploits exist, but the potential for exploitation is significant. Patches are available for some vulnerabilities, and users are advised to restrict access to management interfaces and monitor for suspicious activity. The vulnerabilities were published on August 8 and 9, 2026, with no confirmed exploits reported at this time. 3 sources 74

Extracted Entities

CVE-2026-71992 - Exploits & Severity

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)