Description

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the wps.cgi interface that allows remote attackers to execute arbitrary commands by injecting malicious input through the pin2g, pin5g, or pin6g parameters. Attackers can exploit these unsanitized parameters to execute arbitrary commands on the affected device and obtain root privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-08T23:16:56.967Z",
  "pubdate": "2026-08-08T23:16:56.967Z",
  "executiveSummary": "A command injection vulnerability exists within the wps.cgi interface of the MSI Radix AXE6600 router running firmware version v781521. This security flaw allows remote attackers to execute arbitrary system commands by supplying malicious input via the vulnerable pin2g, pin5g, or pin6g parameters.\nSuccessful exploitation of this vulnerability enables unauthorized remote attackers to execute arbitrary system commands in the context of the underlying operating system. Because the affected firmware processes these requests with high privileges, successful execution grants the attacker root privileges, leading to a complete administrative compromise of the affected device.\nThe vulnerability represents a severe risk to network infrastructure and confidentiality, integrity, and availability. Attackers can leverage network access to the management or web interface to compromise the router, potentially intercepting traffic, modifying network configurations, or using the device as a pivot point for further internal network exploitation. No complex cryptographic bypasses are explicitly required if the interface is reachable, as the flaw stems directly from the lack of input sanitization in parameter processing.",
  "technicalDetails": "The root cause of the vulnerability is the improper sanitization and filtering of user-supplied input within the wps.cgi interface of the MSI Radix AXE6600 firmware version v781521. Specifically, the parameters pin2g, pin5g, and pin6g directly handle input destined for underlying system execution routines without adequate validation or neutralization of shell metacharacters.\nWhen a request is sent to the wps.cgi script, the application extracts the values provided in the pin2g, pin5g, or pin6g parameters. Due to insufficient input validation, an attacker can append malicious shell commands using command separators (such as semicolons, pipe characters, or backticks) to the expected PIN data. This unsanitized string is subsequently passed to the underlying operating system shell for evaluation and execution.\nThe attack flow begins with the adversary identifying network accessibility to the vulnerable wps.cgi endpoint on the MSI Radix AXE6600 device. The attacker crafts a malicious HTTP request containing the payload injected into the vulnerable pin2g, pin5g, or pin6g parameters. Upon receiving the HTTP request, the web server processes the script, which in turn invokes the system shell containing the injected commands.\nBecause the web server or underlying CGI handler executes processes with elevated permissions on this embedded firmware, the injected commands inherit root privileges. This grants the attacker complete control over the host operating system. Post-exploitation impact includes persistent compromise, modification of system binaries, firmware tampering, eavesdropping on local network traffic, and disabling security controls."
}