Description

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the urlfilter function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the urlfilter function to inject malicious commands and obtain root privileges on the underlying system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-09T00:16:47.207Z",
  "pubdate": "2026-08-09T00:16:47.207Z",
  "executiveSummary": "The MSI Radix AXE6600 router running firmware version v781521 is susceptible to a critical command injection vulnerability localized within the urlfilter function.\nThis security flaw enables remote attackers to inject and execute arbitrary system commands directly on the underlying operating system.\nSuccessful exploitation of this vulnerability grants the adversary complete administrative control, resulting in the acquisition of root privileges on the affected device.\nThe presence of a remote command injection vulnerability in a core networking device introduces severe risk implications, including total compromise of network confidentiality, integrity, and availability.\nThreat actors possessing network access to the vulnerable endpoint can leverage this flaw to execute arbitrary payloads, manipulate device configurations, pivot into internal networks, and establish persistent unauthorized access.\nThe attack vector exploits inadequate input sanitization and improper neutralization of special elements within the urlfilter functionality, allowing shell metacharacters to be parsed and executed by the underlying system shell.",
  "technicalDetails": "The vulnerability resides in the urlfilter function of the MSI Radix AXE6600 router running firmware version v781521, which fails to adequately sanitize user-supplied input prior to passing it to the underlying system execution environment.\nRoot cause analysis indicates an insecure implementation of command construction or API handling where parameters intended for URL filtering are concatenated directly into system shell commands without sufficient validation or escaping.\nThe attack flow begins when a remote attacker crafts a malicious HTTP request or interface interaction targeting the urlfilter component.\nBy appending shell metacharacters (such as semicolons, pipes, or backticks) combined with arbitrary system commands to the target parameter, the attacker forces the system shell to interpret the injected string alongside the intended administrative process.\nBecause the web application daemon or underlying service typically operates with elevated privileges, the execution of the injected payload inherits these permissions.\nConsequently, the arbitrary commands executed by the attacker run with full root privileges on the underlying Linux-based operating system.\nNetwork exposure encompasses remote access vectors capable of reaching the vulnerable administrative or routing interfaces that process urlfilter configurations.\nDepending on the configuration, this may be exposed via the local area network or potentially the wide area network if remote management interfaces are enabled.\nPost-exploitation impact is catastrophic, as obtaining root privileges allows the threat actor to disable security controls, install backdoors, intercept network traffic passing through the MSI Radix AXE6600, or utilize the compromised device as a staging point for lateral movement across the connected network infrastructure."
}